CVE-2026-20083

MEDIUM

Cisco IOS XE 3.5.0E-3.5.3E, 3.11.0S-3.11.4S, 3.12.0S-3.12.1S DoS via Malformed SCP

Title source: llm
STIX 2.1

Description

A vulnerability in the Secure Copy Protocol (SCP) server feature of Cisco IOS XE Software could allow an authenticated, local attacker with low privileges to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to improper handling of a malformed SCP request. An attacker could exploit this vulnerability by issuing a crafted command through SSH. A successful exploit could allow the attacker to cause the device to reload unexpectedly, resulting in a DoS condition.

References (1)

Core 1

Scores

CVSS v3 6.5
EPSS 0.0003
EPSS Percentile 9.1%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-235
Status published
Products (50)
Cisco/Cisco IOS XE Software 16.10.1
Cisco/Cisco IOS XE Software 16.10.1a
Cisco/Cisco IOS XE Software 16.10.1b
Cisco/Cisco IOS XE Software 16.10.1c
Cisco/Cisco IOS XE Software 16.10.1d
Cisco/Cisco IOS XE Software 16.10.1e
Cisco/Cisco IOS XE Software 16.10.1f
Cisco/Cisco IOS XE Software 16.10.1g
Cisco/Cisco IOS XE Software 16.10.1s
Cisco/Cisco IOS XE Software 16.10.2
... and 40 more
Published Mar 25, 2026
Tracked Since Mar 25, 2026