Cisco Family May 2025 First Round Security Update Advisory
Overview
Cisco (https://www.cisco.com) has released a security update that fixes vulnerabilities in products it has been made. Users of affected systems are advised to update to the latest version.
Affected Products
Cisco Catalyst Center
Cisco IOS XE Software
Cisco IOS Software
Cisco IOS XE wireless Controller Software
Cisco Adaptive Security Appliance Software
Cisco Catalyst SD-WAN Manager
Cisco IOS XR Software
WLC AireOS Software
other products (see [1])
Resolved Vulnerabilities
Unauthenticated Remote Code Execution Vulnerability in Erlang/OTP SSH Server (CVE-2025-32433) [1] [2
Wireless Controller Software Arbitrary File Upload Vulnerability in Cisco IOS XE Software (CVE-2025-20188) [2]
Denial of Service Vulnerability in Cisco IOS XE Software (CVE-2025-20140) [3]
Web-Based Management Interface Command Vulnerability in Cisco IOS XE Software (CVE-2025-20186) [4]
TWAMP Denial of Service Vulnerability in Cisco IOS Software and Cisco IOS XE Software (CVE-2025-20154) [5]
switch Integrated Security Features DHCPv6 Denial of Service Vulnerability in Multiple Cisco Products (CVE-2025-20191) [6]
Cisco Catalyst SD-WAN Administrator Elevation of Privilege Vulnerability (CVE-2025-20122) [7]
iKEv2 Denial of Service Vulnerability in Multiple Cisco Products (CVE-2025-20182) [8]
Privilege Escalation Vulnerabilities due to Insufficient Input Validation in Cisco IOS XE Software (CVE-2025-20197, CVE-2025-20198, CVE-2025-20199, CVE-2025-20200, CVE-2025-20201) [9]
Software Internet Key Exchange Version 1 Denial of Service Vulnerability (CVE-2025-20192) in Cisco IOS XE Software [10]
DHCP Stooping Denial of Service Vulnerability in Cisco IOS XE Software (CVE-2025-20162) [11]
Industrial Ethernet Switch Device Manager Elevation of Privilege Vulnerability in Cisco IOS Software (CVE-2025-20164) [12]
Cisco Discovery Protocol Denial of Service Vulnerability in Cisco IOS XE Wireless Controller Software (CVE-2025-20202) [13]
Unauthenticated API Access Vulnerability in Cisco Catalyst Center (CVE-2025-20210) [14] [15
Cisco IOS Software Secure Boot Bypass Vulnerability (CVE-2025-20181) [15]
ARP Denial of Service Vulnerability in Cisco IOS XE Software (CVE-2025-20210) [16]
Vulnerability Patches
product-specific Vulnerability Patches were made available in the May 7, 2025 update. please refer to the product-specific information in the Referenced Sites below for “Affected Products” and “Fixed Software” to apply the patches.
Referenced Sites
[1] Multiple Cisco Products Unauthenticated Remote Code Execution in Erlang/OTP SSH Server: April 2025
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-erlang-otp-ssh-xyZZy
[2] Cisco IOS XE Wireless Controller Software Arbitrary File Upload Vulnerability
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-wlc-file-uplpd-rHZG9UfC
[3] Cisco IOS XE Software for WLC Wireless IPv6 Clients Denial of Service Vulnerability
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-wlc-wncd-p6Gvt6HL
[4] Cisco IOS XE Software Web-Based Management Interface Command Injection Vulnerability
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webui-cmdinj-gVn3OKNC
[5] Cisco IOS, IOS XE, and IOS XR Software TWAMP Denial of Service Vulnerability
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-twamp-kV4FHugn
[6] Multiple Cisco Products Switch Integrated Security Features DHCPv6 Denial of Service Vulnerability
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sisf-dos-ZGwt4DdY
[7] Cisco Catalyst SD-WAN Manager Privilege Escalation Vulnerability
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-priviesc-WCk7bmmt
[8] Cisco Adaptive Security Appliance Software, Firepower Threat Defense Software, IOS Software, and IOS XE Software IKEv2 Denial of Service Vulnerability
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-multiprod-ikev2-dos-gPctUqv2
[9] Cisco IOS XE Software Privilege Escalation Vulnerabilities
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-privesc-su7scvdp
[10] Cisco IOS XE Software Internet Key Exchange Version 1 Denial of Service Vulnerability
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-ikev1-dos-XHk3HzFC
[11] Cisco IOS XE Software DHCP Snooping Denial of Service Vulnerability
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-dhcpsn-dos-xBn8Mtks
[12] Cisco IOS Software Industrial Ethernet Switch Device Manager Privilege Escalation Vulnerability
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ios-http-privesc-wCRd5e3
[13] Cisco IOS XE Wireless Controller Software Cisco Discovery Protocol Denial of Service Vulnerability
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ewlc-cdp-dos-fpeks9K
[14] Cisco Catalyst Center Unauthenticated API Access Vulnerability
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-dnac-api-nBPZcJCM
[15] Cisco IOS Software for Cisco Catalyst 2960X, 2960XR, 2960CX, and 3560CX Series Switches Secure Boot Bypass Vulnerability
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-c2960-3560-sboot-ZtqADrHq
[16] Cisco IOS XE Software for Cisco ASR 903 Aggregation Services Routers ARP Denial of Service Vulnerability
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asr903-rsp3-arp-dos-WmfzdvJZ