Cisco IOS XE Software Web Services Remote Code Execution (cisco-sa-http-code-exec-WmfP3h3O)

#TRUSTED 3c1d85f53836c46dd1682dd0f62d8bc2e6692e56be4291ac828dcafe8f3ee2f78d9207b8632c26a2de7f76c092fa561403c9690d4f517554bb209bc5fb7cf47bf57595994742cf1d4e0f227cfc0834d53a72d37f88a1c4f6ef318f93846840228f03c664f852172dfd7859948a79809aedf6a2302f42646ab001ad6a50ebe7bb9df69a9fac2aaab08a02f796f63bfa595c38c08ef8d5b4a29c1be7625edf9587449816c63cacf9377616e338787d3feb1bc5d4b77faa54c634be69d34c9423744c9866e781cbeecb855f18d0fe47d99bd7f67f5e91fa2d9d6f21d084d9b2a28e83ef314910930be104becd38d739daf83501c74e5575328d4cc4f4aa5f4b5be8c2c8007c9bfa5bd12b3f3b61bd33f7ac7fc639aefe801a267d3b0f58f14e472b3896dca669f5c68e6e0b6a98726d94561e9c3590837d939ca36a03ce83e146f7c37bf62548eb613ad9e2598d9e20e5198c3af032e9256d504a6b4c37258bef01ab595383cacfb37f28b46bdc8d1a6c3ea24c0c1ec5b7ad38e5e2db8dd8ec097baf97f3ae1c2d6d35d25e2d457f0969fd80353c7682560aaecd16f01be0bc78c85f2dc99f62c0d1a4a6ec5074f404a9fb1c2795763ecc0e40eef1bb8c925dfaa9c143df7d2129bc5415684f1a9b948c7e49d9189cbdaeeb3d7dde2f53809fad6176959e0496e7270f99388659f52429cb7351687a9166fec7a9c09a23bd182d4b
#TRUST-RSA-SHA256 3d8a5edcd53acee2376b711bd4f9eb21da796748877b84150c2cbd9c1f8b04b81da9a9ec73f74244929c453aa94e58870d3eaa81cf2fb187b0b833c51c28ada0b44f19ce6c36933329e86f1c98ec1f6548ab80ad96c53dcecc74d05e80b69f36b3342a97a5d5637ac7bddbc65f7e9ae7d167d7b602a2f1a153f59a0d45c736bacda7b4ef92203e71a8a6268c5be185bf9b1f009a3bfd6074ea4633b787aec5ccdcadac598fa01d6af1715684f184666e1ca8617ee59853ffb4dccccb807352c3d2317db918f9e6e8b72bc8a2f3dd511dabc119ff64adc915b22f522eb6418ec659935afb073bd49d35c6d5746c994083b6849bd02222731a361e26c26ee1170b78cc9a48774827b8fa32ae215bd7c080e0c700f434abeb071ffdc997f06d3222c992c91014f400cfc8d647a1b3e6d5d66f06250e812ca4f65a3e1f20342b687e94aa39413bad0afcc668766a6e5051e687beba311187fbbacc05d25a875a42c65f529822d5636d19fd3ce1355c94e055937231b697cb3ef5a09098059a393f7b510f48c0c361786f5a1426a2a7d87a8727fc073ead7027d23a3aa2fa10ebd3a9cdf176119cf5ed0ffc4006066e7c8ca7b50ffd5b644b54fe610dd2aec3d4d78605d5c534d2bd05c7599547f8c2eb1d3b46284508024d8b13aa887840a5f2ecbea6ddc948cf7575c61804a58dfc25588fd3b676d89f391749ab793c2e0348864b
#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(265974);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/08/10");

  script_cve_id("CVE-2025-20363");
  script_xref(name:"CISCO-BUG-ID", value:"CSCwo35704");
  script_xref(name:"CISCO-BUG-ID", value:"CSCwo35779");
  script_xref(name:"CISCO-SA", value:"cisco-sa-http-code-exec-WmfP3h3O");
  script_xref(name:"IAVA", value:"2025-A-0702");

  script_name(english:"Cisco IOS XE Software Web Services Remote Code Execution (cisco-sa-http-code-exec-WmfP3h3O)");

  script_set_attribute(attribute:"synopsis", value:
"The remote device is missing a vendor-supplied security patch");
  script_set_attribute(attribute:"description", value:
"According to its self-reported version, Cisco IOS-XE Software is affected by a web services remote code exeuction
vulnerability:

  - A vulnerability in the web services of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software, Cisco
    Secure Firewall Threat Defense (FTD) Software, Cisco IOS Software, Cisco IOS XE Software, and Cisco IOS XR Software
    could allow an unauthenticated, remote attacker (Cisco ASA and FTD Software) or authenticated, remote attacker
    (Cisco IOS, IOS XE, and IOS XR Software) with low user privileges to execute arbitrary code on an affected device.
    This vulnerability is due to improper validation of user-supplied input in HTTP requests. An attacker could exploit
    this vulnerability by sending crafted HTTP requests to a targeted web service on an affected device after obtaining
    additional information about the system, overcoming exploit mitigations, or both. A successful exploit could allow
    the attacker to execute arbitrary code as root, which may lead to the complete compromise of the affected device.
    (CVE-2025-20363)

Please see the included Cisco BIDs and Cisco Security Advisory for more information.");
  # https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-http-code-exec-WmfP3h3O
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?aded9b88");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwo35704");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwo35779");
  script_set_attribute(attribute:"solution", value:
"Upgrade to the relevant fixed version referenced in Cisco bug IDs CSCwo35704 and CSCwo35779");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-20363");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/09/25");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/09/25");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/09/26");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:ios_xe");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CISCO");

  script_copyright(english:"This script is Copyright (C) 2025-2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("cisco_ios_xe_version.nasl");
  script_require_keys("Host/Cisco/IOS-XE/Version");

  exit(0);
}

include('cisco_workarounds.inc');
include('ccf.inc');

var product_info = cisco::get_product_info(name:'Cisco IOS XE Software');

var version_list = make_list(
  '3.2.0SE',
  '3.2.0SG',
  '3.2.10SG',
  '3.2.11SG',
  '3.2.1SE',
  '3.2.1SG',
  '3.2.2SE',
  '3.2.2SG',
  '3.2.3SE',
  '3.2.3SG',
  '3.2.4SG',
  '3.2.5SG',
  '3.2.6SG',
  '3.2.7SG',
  '3.2.8SG',
  '3.2.9SG',
  '3.3.0SE',
  '3.3.0SG',
  '3.3.0SQ',
  '3.3.1SE',
  '3.3.1SG',
  '3.3.1SQ',
  '3.3.2SE',
  '3.3.2SG',
  '3.3.3SE',
  '3.3.4SE',
  '3.3.5SE',
  '3.4.0SG',
  '3.4.0SQ',
  '3.4.1SG',
  '3.4.1SQ',
  '3.4.2SG',
  '3.4.3SG',
  '3.4.4SG',
  '3.4.5SG',
  '3.4.6SG',
  '3.4.7SG',
  '3.4.8SG',
  '3.5.0E',
  '3.5.0SQ',
  '3.5.1E',
  '3.5.1SQ',
  '3.5.2E',
  '3.5.2SQ',
  '3.5.3E',
  '3.5.3SQ',
  '3.5.4SQ',
  '3.5.5SQ',
  '3.5.6SQ',
  '3.5.7SQ',
  '3.5.8SQ',
  '3.6.0aE',
  '3.6.0bE',
  '3.6.0E',
  '3.6.10E',
  '3.6.1E',
  '3.6.2aE',
  '3.6.2E',
  '3.6.3E',
  '3.6.4E',
  '3.6.5aE',
  '3.6.5bE',
  '3.6.5E',
  '3.6.6E',
  '3.6.7aE',
  '3.6.7bE',
  '3.6.7E',
  '3.6.8E',
  '3.6.9aE',
  '3.6.9E',
  '3.7.0bS',
  '3.7.0E',
  '3.7.0S',
  '3.7.0xbS',
  '3.7.1aS',
  '3.7.1E',
  '3.7.1S',
  '3.7.2E',
  '3.7.2S',
  '3.7.2tS',
  '3.7.3E',
  '3.7.3S',
  '3.7.4aS',
  '3.7.4E',
  '3.7.4S',
  '3.7.5E',
  '3.7.5S',
  '3.7.6S',
  '3.7.7S',
  '3.7.8S',
  '3.8.0E',
  '3.8.0S',
  '3.8.10cE',
  '3.8.10dE',
  '3.8.10E',
  '3.8.1E',
  '3.8.1S',
  '3.8.2E',
  '3.8.2S',
  '3.8.3E',
  '3.8.4E',
  '3.8.5aE',
  '3.8.5E',
  '3.8.6E',
  '3.8.7E',
  '3.8.8E',
  '3.8.9E',
  '3.9.0aS',
  '3.9.0E',
  '3.9.0S',
  '3.9.0xaS',
  '3.9.1aS',
  '3.9.1E',
  '3.9.1S',
  '3.9.2bE',
  '3.9.2E',
  '3.9.2S',
  '3.10.0cE',
  '3.10.0E',
  '3.10.0S',
  '3.10.10S',
  '3.10.1aE',
  '3.10.1E',
  '3.10.1S',
  '3.10.1sE',
  '3.10.1xbS',
  '3.10.1xcS',
  '3.10.2aS',
  '3.10.2E',
  '3.10.2S',
  '3.10.2tS',
  '3.10.3E',
  '3.10.3S',
  '3.10.4S',
  '3.10.5S',
  '3.10.6S',
  '3.10.7S',
  '3.10.8aS',
  '3.10.8S',
  '3.10.9S',
  '3.11.0E',
  '3.11.0S',
  '3.11.10E',
  '3.11.11E',
  '3.11.12E',
  '3.11.1aE',
  '3.11.1E',
  '3.11.1S',
  '3.11.2aE',
  '3.11.2E',
  '3.11.2S',
  '3.11.3aE',
  '3.11.3E',
  '3.11.3S',
  '3.11.4E',
  '3.11.4S',
  '3.11.5E',
  '3.11.6E',
  '3.11.7E',
  '3.11.8E',
  '3.11.9E',
  '3.12.0aS',
  '3.12.0S',
  '3.12.1S',
  '3.12.2S',
  '3.12.3S',
  '3.12.4S',
  '3.13.0aS',
  '3.13.0S',
  '3.13.10S',
  '3.13.1S',
  '3.13.2aS',
  '3.13.2S',
  '3.13.3S',
  '3.13.4S',
  '3.13.5aS',
  '3.13.5S',
  '3.13.6aS',
  '3.13.6bS',
  '3.13.6S',
  '3.13.7aS',
  '3.13.7S',
  '3.13.8S',
  '3.13.9S',
  '3.14.0S',
  '3.14.1S',
  '3.14.2S',
  '3.14.3S',
  '3.14.4S',
  '3.15.0S',
  '3.15.1cS',
  '3.15.1S',
  '3.15.2S',
  '3.15.3S',
  '3.15.4S',
  '3.16.0aS',
  '3.16.0bS',
  '3.16.0cS',
  '3.16.0S',
  '3.16.10aS',
  '3.16.10bS',
  '3.16.10S',
  '3.16.1aS',
  '3.16.1S',
  '3.16.2aS',
  '3.16.2bS',
  '3.16.2S',
  '3.16.3aS',
  '3.16.3S',
  '3.16.4aS',
  '3.16.4bS',
  '3.16.4cS',
  '3.16.4dS',
  '3.16.4eS',
  '3.16.4gS',
  '3.16.4S',
  '3.16.5aS',
  '3.16.5bS',
  '3.16.5S',
  '3.16.6bS',
  '3.16.6S',
  '3.16.7aS',
  '3.16.7bS',
  '3.16.7S',
  '3.16.8S',
  '3.16.9S',
  '3.17.0S',
  '3.17.1aS',
  '3.17.1S',
  '3.17.2S',
  '3.17.3S',
  '3.17.4S',
  '3.18.0aS',
  '3.18.0S',
  '3.18.0SP',
  '3.18.1aSP',
  '3.18.1bSP',
  '3.18.1cSP',
  '3.18.1gSP',
  '3.18.1hSP',
  '3.18.1iSP',
  '3.18.1S',
  '3.18.1SP',
  '3.18.2aSP',
  '3.18.2S',
  '3.18.2SP',
  '3.18.3aSP',
  '3.18.3bSP',
  '3.18.3S',
  '3.18.3SP',
  '3.18.4S',
  '3.18.4SP',
  '3.18.5SP',
  '3.18.6SP',
  '3.18.7SP',
  '3.18.8aSP',
  '3.18.9SP',
  '16.1.1',
  '16.1.2',
  '16.1.3',
  '16.2.1',
  '16.2.2',
  '16.3.1',
  '16.3.10',
  '16.3.11',
  '16.3.1a',
  '16.3.2',
  '16.3.3',
  '16.3.4',
  '16.3.5',
  '16.3.5b',
  '16.3.6',
  '16.3.7',
  '16.3.8',
  '16.3.9',
  '16.4.1',
  '16.4.2',
  '16.4.3',
  '16.5.1',
  '16.5.1a',
  '16.5.1b',
  '16.5.2',
  '16.5.3',
  '16.6.1',
  '16.6.10',
  '16.6.2',
  '16.6.3',
  '16.6.4',
  '16.6.4a',
  '16.6.4s',
  '16.6.5',
  '16.6.5a',
  '16.6.5b',
  '16.6.6',
  '16.6.7',
  '16.6.7a',
  '16.6.8',
  '16.6.9',
  '16.7.1',
  '16.7.1a',
  '16.7.1b',
  '16.7.2',
  '16.7.3',
  '16.7.4',
  '16.8.1',
  '16.8.1a',
  '16.8.1b',
  '16.8.1c',
  '16.8.1d',
  '16.8.1e',
  '16.8.1s',
  '16.8.2',
  '16.8.3',
  '16.9.1',
  '16.9.1a',
  '16.9.1b',
  '16.9.1c',
  '16.9.1d',
  '16.9.1s',
  '16.9.2',
  '16.9.2a',
  '16.9.2s',
  '16.9.3',
  '16.9.3a',
  '16.9.3h',
  '16.9.3s',
  '16.9.4',
  '16.9.4c',
  '16.9.5',
  '16.9.5f',
  '16.9.6',
  '16.9.7',
  '16.9.8',
  '16.9.8a',
  '16.9.8b',
  '16.10.1',
  '16.10.1a',
  '16.10.1b',
  '16.10.1c',
  '16.10.1d',
  '16.10.1e',
  '16.10.1f',
  '16.10.1g',
  '16.10.1s',
  '16.10.2',
  '16.10.3',
  '16.11.1',
  '16.11.1a',
  '16.11.1b',
  '16.11.1c',
  '16.11.1s',
  '16.11.2',
  '16.12.1',
  '16.12.10',
  '16.12.10a',
  '16.12.11',
  '16.12.12',
  '16.12.13',
  '16.12.1a',
  '16.12.1c',
  '16.12.1s',
  '16.12.1t',
  '16.12.1w',
  '16.12.1x',
  '16.12.1y',
  '16.12.1z',
  '16.12.1z1',
  '16.12.1z2',
  '16.12.2',
  '16.12.2a',
  '16.12.2s',
  '16.12.2t',
  '16.12.3',
  '16.12.3a',
  '16.12.3s',
  '16.12.4',
  '16.12.4a',
  '16.12.5',
  '16.12.5a',
  '16.12.5b',
  '16.12.6',
  '16.12.6a',
  '16.12.7',
  '16.12.8',
  '16.12.9',
  '17.1.1',
  '17.1.1a',
  '17.1.1s',
  '17.1.1t',
  '17.1.2',
  '17.1.3',
  '17.2.1',
  '17.2.1a',
  '17.2.1r',
  '17.2.1v',
  '17.2.2',
  '17.2.3',
  '17.3.1',
  '17.3.1a',
  '17.3.1w',
  '17.3.1x',
  '17.3.1z',
  '17.3.2',
  '17.3.2a',
  '17.3.3',
  '17.3.3a',
  '17.3.4',
  '17.3.4a',
  '17.3.4b',
  '17.3.4c',
  '17.3.5',
  '17.3.5a',
  '17.3.5b',
  '17.3.6',
  '17.3.7',
  '17.3.8',
  '17.3.8a',
  '17.4.1',
  '17.4.1a',
  '17.4.1b',
  '17.4.1c',
  '17.4.2',
  '17.4.2a',
  '17.5.1',
  '17.5.1a',
  '17.5.1b',
  '17.5.1c',
  '17.6.1',
  '17.6.1a',
  '17.6.1w',
  '17.6.1x',
  '17.6.1y',
  '17.6.1z',
  '17.6.1z1',
  '17.6.2',
  '17.6.3',
  '17.6.3a',
  '17.6.4',
  '17.6.5',
  '17.6.5a',
  '17.6.6',
  '17.6.6a',
  '17.6.7',
  '17.6.8',
  '17.6.8a',
  '17.7.1',
  '17.7.1a',
  '17.7.1b',
  '17.7.2',
  '17.8.1',
  '17.8.1a',
  '17.9.1',
  '17.9.1a',
  '17.9.1w',
  '17.9.1x',
  '17.9.1x1',
  '17.9.1y',
  '17.9.1y1',
  '17.9.2',
  '17.9.2a',
  '17.9.3',
  '17.9.3a',
  '17.9.4',
  '17.9.4a',
  '17.9.5',
  '17.9.5a',
  '17.9.5b',
  '17.9.5c',
  '17.9.5d',
  '17.9.5e',
  '17.9.5f',
  '17.9.6',
  '17.9.6a',
  '17.9.6b',
  '17.9.7',
  '17.10.1',
  '17.10.1a',
  '17.10.1b',
  '17.11.1',
  '17.11.1a',
  '17.11.99SW',
  '17.12.1',
  '17.12.1a',
  '17.12.1w',
  '17.12.1x',
  '17.12.1y',
  '17.12.1z',
  '17.12.1z1',
  '17.12.1z2',
  '17.12.1z3',
  '17.12.1z4',
  '17.12.2',
  '17.12.2a',
  '17.12.3',
  '17.12.3a',
  '17.12.4',
  '17.12.4a',
  '17.12.4b',
  '17.12.5',
  '17.12.5a',
  '17.12.5c',
  '17.13.1',
  '17.13.1a',
  '17.14.1',
  '17.14.1a',
  '17.15.1',
  '17.15.1a',
  '17.15.1b',
  '17.15.1w',
  '17.15.1x',
  '17.15.1y',
  '17.15.1z',
  '17.15.2',
  '17.15.2a',
  '17.15.2b',
  '17.15.2c',
  '17.15.3',
  '17.16.1',
  '17.16.1a',
  '17.17.1'
);

var workarounds = make_list(CISCO_WORKAROUNDS['iosxe_remote_access_ssl_vpn']);

var reporting = make_array(
  'port'    , product_info['port'],
  'severity', SECURITY_HOLE,
  'version' , product_info['version'],
  'bug_id'  , 'CSCwo35704, CSCwo35779',
  'cmds'    , make_list('show running-config | section crypto ssl policy')
);

cisco::check_and_report(
  product_info:product_info,
  workarounds:workarounds,
  reporting:reporting,
  vuln_versions:version_list
);