Use of Uninitialized Variable in Cisco Systems, Inc products - CVE-2025-20212
Published: April 3, 2025
Vulnerability identifier: #VU106921
CSH Severity: Medium
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2025-20212
CWE-ID: CWE-457
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to uninitialized variable in the Cisco AnyConnect VPN server when an SSL VPN session is established. A remote user can cause a denial of service condition on the target system.
Affected software
Meraki MX75
Meraki Z4C
Meraki Z4
Meraki Z3C
Meraki Z3
Meraki vMX
Meraki MX600
Meraki MX450
Meraki MX400
Meraki MX250
Meraki MX105
Meraki MX100
Meraki MX95
Meraki MX85
Meraki MX84
Meraki MX68W
Meraki MX68CW
Meraki MX68
Meraki MX67W
Meraki MX67C
Meraki MX67
Meraki MX65W
Meraki MX65
Meraki MX64W
Meraki MX64
Meraki MX
Meraki Z4C
Meraki Z4
Meraki Z3C
Meraki Z3
Meraki vMX
Meraki MX600
Meraki MX450
Meraki MX400
Meraki MX250
Meraki MX105
Meraki MX100
Meraki MX95
Meraki MX85
Meraki MX84
Meraki MX68W
Meraki MX68CW
Meraki MX68
Meraki MX67W
Meraki MX67C
Meraki MX67
Meraki MX65W
Meraki MX65
Meraki MX64W
Meraki MX64
Meraki MX
How to mitigate CVE-2025-20212
Install updates from vendor's website.
Meraki MX - addressed in versions 18.107.12, 18.211.4, 19.1.4