Use of Uninitialized Variable in Cisco Systems, Inc products - CVE-2025-20212

 

Use of Uninitialized Variable in Cisco Systems, Inc products - CVE-2025-20212

Published: April 3, 2025


Vulnerability identifier: #VU106921
CSH Severity: Medium
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2025-20212
CWE-ID: CWE-457
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to uninitialized variable in the Cisco AnyConnect VPN server when an SSL VPN session is established. A remote user can cause a denial of service condition on the target system.


Affected software

Meraki MX75
Meraki Z4C
Meraki Z4
Meraki Z3C
Meraki Z3
Meraki vMX
Meraki MX600
Meraki MX450
Meraki MX400
Meraki MX250
Meraki MX105
Meraki MX100
Meraki MX95
Meraki MX85
Meraki MX84
Meraki MX68W
Meraki MX68CW
Meraki MX68
Meraki MX67W
Meraki MX67C
Meraki MX67
Meraki MX65W
Meraki MX65
Meraki MX64W
Meraki MX64
Meraki MX

How to mitigate CVE-2025-20212

Install updates from vendor's website.

Meraki MX - addressed in versions 18.107.12, 18.211.4, 19.1.4

External References

Related Security Bulletins