Cisco IOS XE Software Wireless Controller Discovery Protocol DoS (cisco-sa-ewlc-cdp-dos-fpeks9K)

#TRUSTED 7f60816b968d2b00c80c20a4121d45008568d9e0ff9ce283d6c562a8bd882643de0e7add94f5d242d2786b519d5ce068a4dbea250a4818176cbae220f5e5a6da9249d03dce568868a6d54e683bb2c40d475f23c03e97cff7abb1b3d352461d8c464c34f0b1aa9650ee1b71505095d08b891e57e4c7e003a8a212a5b1d69c6a5002e79003c49ea9f6435b770bb6867c0dd668b2a456a0d84cdf73448a029b5efb912db188b45a17eca931c846640a2b5a469130b7724d1bff2c77a11f8ead251e331eed99cd6e0a9194389f7af6962296fd04b6f69a07a453aaf8448b491659547f0a4dc2cb531a02f420169ea37d1ebfb02bdf06cf521fd0bddacb509df76a53b64f7f65be671d2083ac81a7808c6585ec853653ca131c77100fdfe0269724b01b5982b9650193a213cca1edba467741d9bbb0f5852702604ce27b7d68a2a588a750f2af6c746f8027705e149e9785984f199de5fe913c746b3f9fefe84d42c6b0f85614e9536ce3ea4b8f32340a754ef8a4d321d80267939606fc0ffc2a7d7ff3d0a52b639cba20f47e1e831ea9001702ac64cabe14ea2d4bfb07e70f0a6693a80b4233d4c8fdef19875042fb948e87db89dc4c789844c0161b18daab69b60bc3bd4371425cdad344faa2c6626739aa98e2d4ff64367117fb95731736317419779469f899adfea3d7bcf0a1e124bd7292cabded8d42947e1bea1bdce0e2cbd2
#TRUST-RSA-SHA256 81521cc6d8a39c132bb0f4591c18918037eb32418bccf82c696c339ce4f29fe3d4d7d339919f7c1be494dfc4c08723b014dd5d6aaf1d8fb8d357040ab65c54b3054ee1f903a849950e1fbe96ea0453041ba4426739360b271bea7b2a319cd53642943f8d210fb976c6c7a17660ec0718d06e60d84f0a60b89615ff06f364cc971d8f8b7e734cffb485bef87ebda0ffbeb40d3f96f9985dbfdc75ebb90c91203d8ee0acfd606dc370fca3b9791ed4d0cb374efa61fcfb79532188efc507ddb63384f4bb392aa149ff2402bb3bfec6b0662b67f81ce6f9b2840af458496ee6cc8e6f7026222465fdcfe52ba54919e1313e31084263e7ee55e58d1a0172a9c89e2adec96361f3d9d4f461e6add5cf1b0d5bf59cc91bb3fa75a2c2a91b9d555075b03244efd425863d06bc5b00235cdd11657f9ec98c405ee309bd2a39c5cd13a986f02be4dba946ba2a619e1d39738cdcf32f0cb8ac833850f766952e5ce185271f2c6fa4ff070c5ef1922b5461843c17f89849ab3dcae6b11d39cbfeb92ba9663c7e1b30f447fa7ca31abf86c775ae51ae5618129868b74bf424432db2ad434a782620a7c7c2b26ebbaeceea317f58f6cd579cb2b35e22471f73f8488f7abf4c48e1eddf0dd5515d7eaa1cf89a50210b10341a8a55b103fcfaa3ac89e2e0dee41206a732b9746254afd86adcb7474f843efdef73ad5204e5e594d1713282656192
#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(325419);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/08/26");

  script_cve_id("CVE-2025-20202");
  script_xref(name:"CISCO-BUG-ID", value:"CSCwm14282");
  script_xref(name:"CISCO-SA", value:"cisco-sa-ewlc-cdp-dos-fpeks9K");
  script_xref(name:"IAVA", value:"2025-A-0318");

  script_name(english:"Cisco IOS XE Software Wireless Controller Discovery Protocol DoS (cisco-sa-ewlc-cdp-dos-fpeks9K)");

  script_set_attribute(attribute:"synopsis", value:
"The remote device is missing a vendor-supplied security patch");
  script_set_attribute(attribute:"description", value:
"According to its self-reported version, Cisco IOS-XE Software is affected by a vulnerability.

  - A vulnerability in Cisco IOS XE Wireless Controller Software could allow an unauthenticated, adjacent
    attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to
    insufficient input validation of access point (AP) Cisco Discovery Protocol (CDP) neighbor reports when
    they are processed by the wireless controller. An attacker could exploit this vulnerability by sending a
    crafted CDP packet to an AP. A successful exploit could allow the attacker to cause an unexpected reload
    of the wireless controller that is managing the AP, resulting in a DoS condition that affects the wireless
    network. (CVE-2025-20202)

Please see the included Cisco BIDs and Cisco Security Advisory for more information.");
  # https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ewlc-cdp-dos-fpeks9K
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?0a363765");
  # https://sec.cloudapps.cisco.com/security/center/viewErp.x?alertId=ERP-75279
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?564dd2a1");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwm14282");
  script_set_attribute(attribute:"solution", value:
"Upgrade to the relevant fixed version referenced in Cisco bug ID CSCwm14282");
  script_set_cvss_base_vector("CVSS2#AV:A/AC:L/Au:N/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-20202");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(805);

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/05/07");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/05/07");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/07/07");

  script_set_attribute(attribute:"potential_vulnerability", value:"true");
  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:ios_xe");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CISCO");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("cisco_ios_xe_version.nasl");
  script_require_keys("Host/Cisco/IOS-XE/Version", "Settings/ParanoidReport", "Host/Cisco/IOS-XE/Model");

  exit(0);
}

include('cisco_workarounds.inc');
include('ccf.inc');

if (report_paranoia < 2)
  audit(AUDIT_PARANOID);

var product_info = cisco::get_product_info(name:'Cisco IOS XE Software');

var model = toupper(product_info.model);

# Model-based exclusions
if (model !~ "C9(3|4|5|8)[0-9]{2}")
  audit(AUDIT_HOST_NOT, 'affected');

var version_list=make_list(
  '16.10.1',
  '16.10.1a',
  '16.10.1b',
  '16.10.1c',
  '16.10.1d',
  '16.10.1e',
  '16.10.1f',
  '16.10.1g',
  '16.10.1s',
  '16.10.2',
  '16.10.3',
  '16.11.1',
  '16.11.1a',
  '16.11.1b',
  '16.11.1c',
  '16.11.1s',
  '16.11.2',
  '16.12.1',
  '16.12.1a',
  '16.12.1c',
  '16.12.1s',
  '16.12.1t',
  '16.12.1w',
  '16.12.1x',
  '16.12.1y',
  '16.12.1z',
  '16.12.1z1',
  '16.12.1z2',
  '16.12.2',
  '16.12.2a',
  '16.12.2s',
  '16.12.2t',
  '16.12.3',
  '16.12.3a',
  '16.12.3s',
  '16.12.4',
  '16.12.4a',
  '16.12.5',
  '16.12.5a',
  '16.12.5b',
  '16.12.6',
  '16.12.6a',
  '16.12.7',
  '16.12.8',
  '16.12.9',
  '16.12.10',
  '16.12.10a',
  '16.12.11',
  '16.12.12',
  '17.1.1',
  '17.1.1a',
  '17.1.1s',
  '17.1.1t',
  '17.1.2',
  '17.1.3',
  '17.2.1',
  '17.2.1a',
  '17.2.1r',
  '17.2.1v',
  '17.2.2',
  '17.2.3',
  '17.3.1',
  '17.3.1a',
  '17.3.1w',
  '17.3.1x',
  '17.3.1z',
  '17.3.2',
  '17.3.2a',
  '17.3.3',
  '17.3.3a',
  '17.3.4',
  '17.3.4a',
  '17.3.4b',
  '17.3.4c',
  '17.3.5',
  '17.3.5a',
  '17.3.5b',
  '17.3.6',
  '17.3.7',
  '17.3.8',
  '17.3.8a',
  '17.4.1',
  '17.4.1a',
  '17.4.1b',
  '17.4.1c',
  '17.4.2',
  '17.4.2a',
  '17.5.1',
  '17.5.1a',
  '17.5.1b',
  '17.5.1c',
  '17.6.1',
  '17.6.1a',
  '17.6.1w',
  '17.6.1x',
  '17.6.1y',
  '17.6.1z',
  '17.6.1z1',
  '17.6.2',
  '17.6.3',
  '17.6.3a',
  '17.6.4',
  '17.6.5',
  '17.6.5a',
  '17.6.6',
  '17.6.6a',
  '17.6.7',
  '17.6.8',
  '17.6.8a',
  '17.7.1',
  '17.7.1a',
  '17.7.1b',
  '17.7.2',
  '17.8.1',
  '17.8.1a',
  '17.9.1',
  '17.9.1a',
  '17.9.1w',
  '17.9.1x',
  '17.9.1x1',
  '17.9.1y',
  '17.9.1y1',
  '17.9.2',
  '17.9.2a',
  '17.9.3',
  '17.9.3a',
  '17.9.4',
  '17.9.4a',
  '17.9.5',
  '17.9.5a',
  '17.9.5b',
  '17.9.5c',
  '17.9.5d',
  '17.9.5e',
  '17.9.5f',
  '17.10.1',
  '17.10.1a',
  '17.10.1b',
  '17.11.1',
  '17.11.1a',
  '17.11.99SW',
  '17.12.1',
  '17.12.1a',
  '17.12.1w',
  '17.12.1x',
  '17.12.1y',
  '17.12.1z',
  '17.12.1z1',
  '17.12.2',
  '17.12.2a',
  '17.12.3',
  '17.12.3a',
  '17.12.4',
  '17.12.4a',
  '17.12.4b',
  '17.13.1',
  '17.13.1a',
  '17.14.1',
  '17.14.1a',
  '17.15.1',
  '17.15.1a',
  '17.15.1b',
  '17.15.1w'
);

var reporting = make_array(
  'port'    , product_info['port'],
  'severity', SECURITY_WARNING,
  'version' , product_info['version'],
  'bug_id'  , 'CSCwm14282'
);

cisco::check_and_report(
  product_info:product_info,
  reporting:reporting,
  vuln_versions:version_list
);