Back to the CVE list
CVE-2025-20160

Improper authentication in Cisco Ios

CVSS score

8.1

EPSS probability

%0.4

Risk score

0.0

Published

1 y ago

OverviewPublic Exploits (0)NewsroomVulnerability Timeline
Patch status has not yet been verified

Resmî kaynaklarda yeterli kanıt bulunamadı. Bu sonuç “yama yok” anlamına gelmez.

Impact on My Inventory

Only the personal products you have added to your account are assessed; an organisation's inventory does not appear here.

Checking session…

Vulnerability description

DayBreach CVE AI Research

CVE-2025-20160 has vendor, distribution, patch and security-source records on file. We can compare them and prepare an explanation linked to the evidence.

A vulnerability in the implementation of the TACACS+ protocol in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to view sensitive data or bypass authentication. This vulnerability exists because the system does not properly check whether the required TACACS+ shared secret is configured. A machine-in-the-middle attacker could exploit this vulnerability by intercepting and reading unencrypted TACACS+ messages or impersonating the TACACS+ server and falsely accepting arbitrary authentication requests. A successful exploit could allow the attacker to view sensitive information in a TACACS+ message or bypass authentication and gain access to the affected device.

IMPACT: Affected Products and Software

Affected Products

The following products are affected by CVE-2025-20160 vulnerability. Where our threat engine knows the exact affected versions, they are listed below.

IDVENDORPRODUCTACTION
1ciscoios View
2ciscoios View
3ciscoios View
4ciscoios View
5ciscoios View
6ciscoios View
7ciscoios View
8ciscoios View
9ciscoios View
10ciscoios View
11ciscoios View
12ciscoios View
13ciscoios View
14ciscoios View
15ciscoios View
16ciscoios View
17ciscoios View
18ciscoios View
19ciscoios View
20ciscoios View
21ciscoios View
22ciscoios View
23ciscoios View
24ciscoios View
25ciscoios View
26ciscoios View
27ciscoios View
28ciscoios View
29ciscoios View
30ciscoios View
31ciscoios View
32ciscoios View
33ciscoios View
34ciscoios View
35ciscoios View
36ciscoios View
37ciscoios View
38ciscoios View
39ciscoios View
40ciscoios View
41ciscoios View
42ciscoios View
43ciscoios View
44ciscoios View
45ciscoios View
46ciscoios View
47ciscoios View
48ciscoios View
49ciscoios View
50ciscoios View
51ciscoios View
52ciscoios View
53ciscoios View
54ciscoios View
55ciscoios View
56ciscoios View
57ciscoios View
58ciscoios View
59ciscoios View
60ciscoios View
61ciscoios View
62ciscoios View
63ciscoios View
64ciscoios View
65ciscoios View
66ciscoios View
67ciscoios View
68ciscoios View
69ciscoios View
70ciscoios View
71ciscoios View
72ciscoios View
73ciscoios View
74ciscoios View
75ciscoios View
76ciscoios View
77ciscoios View
78ciscoios View
79ciscoios View
80ciscoios View
81ciscoios View
82ciscoios View
83ciscoios View
84ciscoios View
85ciscoios View
86ciscoios View
87ciscoios View
88ciscoios View
89ciscoios View
90ciscoios View
91ciscoios View
92ciscoios View
93ciscoios View
94ciscoios View
95ciscoios View
96ciscoios View
97ciscoios View
98ciscoios View
99ciscoios View
100ciscoios View
101ciscoios View
102ciscoios View
103ciscoios View
104ciscoios View
105ciscoios View
106ciscoios View
107ciscoios View
108ciscoios View
109ciscoios View
110ciscoios View
111ciscoios View
112ciscoios View
113ciscoios View
114ciscoios View
115ciscoios View
116ciscoios View
117ciscoios View
118ciscoios View
119ciscoios View
120ciscoios View
121ciscoios View
122ciscoios View
123ciscoios View
124ciscoios View
125ciscoios xe View
126ciscoios xe View
127ciscoios xe View
128ciscoios xe View
129ciscoios xe View
130ciscoios xe View
131ciscoios xe View
132ciscoios xe View
133ciscoios xe View
134ciscoios xe View
135ciscoios xe View
136ciscoios xe View
137ciscoios xe View
138ciscoios xe View
139ciscoios xe View
140ciscoios xe View
141ciscoios xe View
142ciscoios xe View
143ciscoios xe View
144ciscoios xe View
145ciscoios xe View
146ciscoios xe View
147ciscoios xe View
148ciscoios xe View
149ciscoios xe View
150ciscoios xe View
151ciscoios xe View
152ciscoios xe View
153ciscoios xe View
154ciscoios xe View
155ciscoios xe View
156ciscoios xe View
157ciscoios xe View
158ciscoios xe View
159ciscoios xe View
160ciscoios xe View
161ciscoios xe View
162ciscoios xe View
163ciscoios xe View
164ciscoios xe View
165ciscoios xe View
166ciscoios xe View
167ciscoios xe View
168ciscoios xe View
169ciscoios xe View
170ciscoios xe View
171ciscoios xe View
172ciscoios xe View
173ciscoios xe View
174ciscoios xe View
175ciscoios xe View
176ciscoios xe View
177ciscoios xe View
178ciscoios xe View
179ciscoios xe View
180ciscoios xe View
181ciscoios xe View
182ciscoios xe View
183ciscoios xe View
184ciscoios xe View
185ciscoios xe View
186ciscoios xe View
187ciscoios xe View
188ciscoios xe View
189ciscoios xe View
190ciscoios xe View
191ciscoios xe View
192ciscoios xe View
193ciscoios xe View
194ciscoios xe View
195ciscoios xe View
196ciscoios xe View
197ciscoios xe View
198ciscoios xe View
199ciscoios xe View
200ciscoios xe View
Total affected vendors: 1|Products: 200

RED HAT CSAF/VEX: Product Impact Check

Red Hat has not yet published a CSAF/VEX impact record for this CVE. This does not mean “not affected”.

SCORING: CVSS from Multiple Sources

CVSS Scores

The Common Vulnerability Scoring System is a standardised framework for assessing the severity of vulnerabilities in software and systems. We collect and display CVSS scores from several sources for each CVE.

SCOREVERSIONSEVERITYVECTORSOURCE
8.1CVSS V31HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HNVD

Patch and Remediation Guide

Solution & Remediation Advisory

Patch status unknown

İncelenen resmî kaynaklarda yama durumu doğrulanamadı. Bu sonuç “yama yok” anlamına gelmez.

Confirm the affected product and version against the source evidence above.
Restrict access to internet-facing services and apply network segmentation.
Until a patch is confirmed, follow the vendor advisory; do not read an unknown status as “no patch”.
Monitor server logs and network endpoints for signs of anomalous execution.

Public exploit and active exploitation status

Verified exploit intelligence

No verified public PoC, exploit repository or Metasploit module has been found for this CVE yet.

Weakness Classification and Attack Patterns (CWE & CAPEC)

CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorises the common flaws or weaknesses that can lead to vulnerabilities. CVE-2025-20160 is associated with the following CWEs:

CWE-287: Improper Authentication

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2025-20160 weaknesses.

CAPEC-66: SQL InjectionCAPEC-126: Path TraversalCAPEC-28: OS Command Injection

Attack Vector and Accessibility

ExposureAğ üzerinden
PermissionsGerekmiyor
UserGerekmiyor

Official Sources and Advisories

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ios-tacacs-hdB7thJwvendor-advisory

CVSS Vector Radar Chart

8.1 / 10
Attack VectorNetworkComplexityHighPrivilegesNoneUser Interact.NoneConfidentialityHighIntegrityNoneAvailabilityHigh

Vulnerability Scoring Details

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack VectorNetwork
Attack ComplexityHigh
Privileges RequiredNone required
User InteractionNone required
Confidentiality (Gizlilik)High
Integrity (Bütünlük)None
Availability (Erişilebilirlik)High

Yama durumu bilinmiyor

İncelenen resmî kaynaklarda yama durumu doğrulanamadı. Bu sonuç “yama yok” anlamına gelmez.

Follow the vendor

C
cisco logo
cisco

Weakness Type (CWE & CAPEC)

CWE-287

Similar Vulnerabilities

Get this vulnerability through the API

Affected products, version ranges, exploitation status and patch information in a single request, with a free key.

Get a free keyDocumentation
curl -H "x-api-key: $DAYBREACH_API_KEY" \
  "https://api.daybreach.dev/api/v1/intel/cves/CVE-2025-20160"