CVE-2026-20125

A vulnerability in the HTTP Server feature of Cisco IOS Software and Cisco IOS XE Software Release 3E could allow an authenticated, remote attacker to cause an affected device to reload unexpectedly, resulting in a denial of service (DoS) condition. This vulnerability is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by sending malformed HTTP requests to an affected device. A successful exploit could allow the attacker to cause a watchdog timer to expire and the device to reload, resulting in a DoS condition. To exploit this vulnerability, the attacker must have a valid user account.

Scoring

Severity

HIGH

CVSS base score

7.7

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

EPSS probability

0.28%

CWE

CWE-228

Published

2026-03-25

Last modified

2026-03-25

Affected products

• Cisco IOS
• Cisco IOS
• Cisco IOS
• Cisco IOS
• Cisco IOS
• Cisco IOS
• Cisco IOS
• Cisco IOS

Weakness type

• CWE-228

Related vulnerabilities

• CVE-2026-87986 — An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command...
• CVE-2026-50103 — Improper Handling of Syntactically Invalid Structure in MZ Automation libIEC61850
• CVE-2025-59174 — Ericsson Packet Core Controller (PCC) versions prior to 1.39 contain a vulnerability where an...
• CVE-2026-25657 — Ericsson Packet Core Gateway (PCG) - Improper Handling of Syntactically Invalid Structure Vulnerability
• CVE-2026-42100 — DoS in Sparx Pro Cloud Server
• CVE-2026-34232 — Firebird: DoS via `op_response` packet from client
• CVE-2024-53828 — Ericsson Packet Core Controller (PCC) - Improper Handling of Syntactically Invalid Structure Vulnerability
• CVE-2025-2529 — IBM Terracotta denial of service

Markdown version · Browse all CVEs