EUVD-2026-15429
GHSA-74wh-qxxr-jvr4
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V14 - Configuration Dependency management, component inventory
|
| Impact | The CVSS v3.1 score of 6.5 reflects a Medium severity with important context: the attack vector is Local (AV:L), attack complexity is Low (AC:L), requires Low privileges (PR:L), no user interaction (UI:N), and impacts availability across the system scope (S:C/A:H). This scoring is appropriate for the threat profile. The primary risk is operational: any authenticated user on the device (including those with minimal SSH access for file transfer or read-only management) can cause a denial of service. Unlike remote code execution or privilege escalation vulnerabilities, this does not enable attacker persistence or data theft, limiting long-term risk. However, the breadth of affected versions (hundreds of minor releases spanning from 2013-era code streams through 2026) and the ease of exploitation (single malformed command) elevate practical risk in environments where SSH is exposed to untrusted users or where access controls are weak. The absence of a public proof-of-concept and lack of evidence of active exploitation in the wild suggests this is not yet weaponized, but the simplicity of the attack vector makes exploitation trivial once discovered. Organizations running internet-facing or multi-tenant systems should prioritize remediation to prevent availability attacks. The EUVD registry listing (EUVD-2026-15429) indicates this received formal EU vulnerability disclosure processing, adding institutional credibility to the severity assessment. |
| Exploit ScenarioDerived | An attacker with SSH credentials to a Cisco IOS XE device (obtained through credential compromise, insider access, or weak password practices) connects to the device via SSH and issues a specially crafted SCP command designed to trigger the parsing flaw in the SCP server implementation. The malformed request causes an exception in the protocol handler that is not properly caught, resulting in a process crash or kernel panic that forces the device to reload. The device becomes unreachable for 2-5 minutes during the reboot cycle, disrupting routing, switching, or security services until recovery is complete. This attack requires no sophisticated tools—it can be executed with a single SSH command—making it attractive for disgruntled insiders or adversaries with SSH access who seek to disrupt service availability without leaving traces of data exfiltration or configuration changes. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 25, 2026
Improper validation of malformed SCP requests in Cisco IOS XE Software allows authenticated local attackers to trigger unexpected device reloads and cause service disruption. An attacker with low privileges can exploit this vulnerability by sending a crafted SSH command to the SCP server component. No patch is currently available for this denial of service vulnerability.
Earlier versions of this analysis (1)
A denial of service vulnerability exists in Cisco IOS XE Software's Secure Copy Protocol (SCP) server implementation that allows authenticated local attackers with low privileges to crash affected devices by sending a malformed SCP request over SSH. An attacker can trigger an unexpected device reload, causing service disruption. The vulnerability affects a broad range of Cisco IOS XE versions across multiple release trains (3.x, 16.x, 17.x) with no known public exploit code at this time, though the attack requires only SSH access with minimal privileges.
RemediationAI
The primary remediation is to upgrade Cisco IOS XE Software to a patched version when released by Cisco; consult the official Cisco Security Advisory (https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-scp-dos-duAdXtCg) for the specific target version for your hardware platform and release train. Until patched versions are available or deployed, implement the following compensating controls: (1) Disable the SCP server feature on the device using the no ip scp server enable command if SCP is not required for operational automation; (2) Restrict SSH access to the device using access control lists (ACLs) or firewall rules to limit connectivity to known management workstations and jump hosts; (3) Use AAA authentication with strong credentials and audit SSH login attempts to detect unauthorized access attempts; (4) Monitor device reload events and set up alerts for unexpected reloads that may indicate exploitation attempts. Organizations unable to disable SCP should prioritize patching in their change management process, as this vulnerability can be exploited by any authenticated SSH user with low privileges.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in the SCP server feature of Cisco IOS XE Software, a network operating system used in enterprise routing and switching infrastructure. SCP (Secure Copy Protocol) is a legacy file transfer protocol that runs over SSH and is commonly used for device management and configuration backup. The root cause is classified under CWE-235 (Improper Handling of Incorrect Relation in Data), indicating that the SCP request parser fails to properly validate or handle malformed protocol messages. When a crafted SCP command is issued through an SSH session, the vulnerable code path does not correctly process the invalid input, leading to an unhandled exception or memory corruption that forces a device reload. The CPE identifier cpe:2.3:a:cisco:cisco_ios_xe_software confirms this affects the core Cisco IOS XE software distribution across multiple hardware platforms.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionCVE.org
A vulnerability in the Secure Copy Protocol (SCP) server feature of Cisco IOS XE Software could allow an authenticated, local attacker with low privileges to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to improper handling of a malformed SCP request. An attacker could exploit this vulnerability by issuing a crafted command through SSH. A successful exploit could allow the attacker to cause the device to reload unexpectedly, resulting in a DoS condition.
Executive ViewAI
CVE-2026-20083 presents notable security risk rated CVSS 6.5. Exploitation could compromise the security of affected deployments. Organizations should apply vendor updates when available and monitor for exploitation.
Apply vendor patch. If patching is delayed: restrict network access and enable monitoring.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB