EUVD-2026-15440Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Privilege assignment review
|
| Impact | The CVSS v3.1 score of 6.5 (Medium-High) reflects a local attack vector with low complexity and low privilege requirements, but the vulnerability's real-world risk must be contextualized carefully. The attack requires prior authenticated local access to the device CLI, which is typically restricted to authorized network engineers and administrators in production environments; this significantly raises the bar compared to unauthenticated remote attacks. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H) correctly identifies that while confidentiality and integrity are unaffected, availability impact is high and scope is changed (other connected systems are affected when interfaces shut down). However, the availability impact is reversible—an administrator can immediately restore functionality via the stop maintenance command without rebooting or manual intervention—making this a transient DoS rather than a persistent compromise. The vulnerability does not appear to be actively exploited or widely discussed in threat intelligence, and the extremely broad version range (200+ affected versions) suggests this may be a recently discovered issue affecting legacy deployments. For organizations with strict CLI access controls and network segmentation, the practical risk is lower; for those with permissive local access policies or shared device credentials, risk is elevated. |
| Exploit ScenarioDerived | An insider or compromised contractor with low-level CLI credentials (such as a help desk account or shared read-only monitoring account) connects to the management CLI of a production router via SSH and executes the start maintenance command without elevated privileges. The device immediately enters maintenance mode, shutting down all interfaces and causing a network outage affecting downstream connected systems until an administrator logs in and executes stop maintenance. The attack requires no special tools, no user interaction (UI:N), and takes seconds to execute, making it an attractive denial-of-service vector for malicious insiders despite the low attack complexity. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 25, 2026
Insufficient privilege validation on the start maintenance command in Cisco IOS XE Software enables authenticated local attackers to trigger a denial of service by placing devices into maintenance mode, which disables network interfaces. Low-privileged users can exploit this via CLI access without administrative credentials. Device recovery requires administrator intervention using the stop maintenance command.
Earlier versions of this analysis (1)
A privilege escalation vulnerability exists in the Cisco IOS XE Software CLI that allows authenticated local attackers with low privileges to execute the start maintenance command, placing the device into maintenance mode and causing a denial of service by shutting down interfaces. The vulnerability affects an extremely broad range of Cisco IOS XE Software versions from 16.6.x through 17.18.x, impacting potentially thousands of deployed network devices. An attacker with local CLI access can trigger this DoS condition, though administrators can restore operations by connecting to the CLI and executing the stop maintenance command; there is no indication of active exploitation in the wild or public proof-of-concept code availability.
RemediationAI
Customers must upgrade Cisco IOS XE Software to patched versions identified in Cisco's official security advisory at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-mntc-dos-LZweQcyq, with specific recommended versions provided per device platform and release train. As an interim mitigation, restrict CLI access through role-based access control (RBAC) by assigning low-privileged users to privilege levels that exclude access to the start maintenance command; ensure only administrative staff retain privilege level 15 access. Additionally, implement network segmentation and access control lists to limit which subnets and users can establish CLI sessions to network devices, and employ monitoring to alert on any start maintenance command execution. Given the reversibility of the DoS (the stop maintenance command immediately restores service), organizations should also ensure procedures are in place for rapid incident response to quickly issue stop maintenance if the command is inadvertently or maliciously executed.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability stems from incorrect privilege assignment to the CLI start maintenance command in Cisco IOS XE Software, classified under CWE-266 (Improper Privilege Management). Cisco IOS XE is the software platform running on Cisco Catalyst, ASR, ISR, and other enterprise network devices, where the CLI serves as the primary management interface. The affected software component (cpe:2.3:a:cisco:cisco_ios_xe_software) spans versions 16.6.1 through 17.18.1a, representing multiple major release families. The root cause is that the start maintenance command should be restricted to high-privilege administrative users but is instead accessible to low-privileged authenticated users, allowing them to invoke system-level device state transitions that result in interface shutdown and network unavailability.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionCVE.org
A vulnerability in the CLI of Cisco IOS XE Software could allow an authenticated, local attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability exists because incorrect privileges are associated with the start maintenance command. An attacker could exploit this vulnerability by accessing the management CLI of the affected device as a low-privileged user and using the start maintenance command. A successful exploit could allow the attacker to put the device in maintenance mode, which shuts down interfaces, resulting in a denial of service (DoS) condition. In case of exploitation, a device administrator can connect to the CLI and use the stop maintenance command to restore operations.
Executive ViewAI
CVE-2026-20110 presents notable security risk rated CVSS 6.5. Exploitation could compromise the security of affected deployments. Organizations should apply vendor updates when available and monitor for exploitation.
Apply vendor patch. If patching is delayed: restrict network access and enable monitoring.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
GitHub PoC
Exploit-DB