CVE-2026-20083

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

A vulnerability in the Secure Copy Protocol (SCP) server feature of Cisco IOS XE Software could allow an authenticated, local attacker with low privileges to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to improper handling of a malformed SCP request. An attacker could exploit this vulnerability by issuing a crafted command through SSH. A successful exploit could allow the attacker to cause the device to reload unexpectedly, resulting in a DoS condition.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

Weakness enumeration

CWE-235

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
CiscoCisco IOS XE Software3.5.0E; 3.5.1E; 3.5.2E; 3.5.3E; 3.11.1S; 3.11.2S; 3.11.0S; 3.11.3S; 3.11.4S; 3.12.0S; 3.12.1S; 3.12.2S; 3.12.3S; 3.12.0aS; 3.12.4S; 3.13.0S; 3.13.1S; 3.13.2S; 3.13.3S; 3.13.4S

References

Timeline

Published
Mar 25, 2026
Last modified
Jun 17, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-200848.6A vulnerability in the DHCP snooping feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause BOOTP packetsCVE-2026-200856.1A vulnerability in the web-based management interface of Cisco IMC could allow an unauthenticated, remote attacker to conduct a reflected XSCVE-2026-200868.6A vulnerability in the processing of Control and Provisioning of Wireless Access Points (CAPWAP) packets of Cisco IOS XE Wireless ControllerCVE-2026-200874.8A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with administrative privileCVE-2026-200884.8A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with administrative privileCVE-2026-200894.8A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with administrative privileCVE-2026-20096.5A flaw has been found in SourceCodester Gas Agency Management System 1.0. This issue affects some unknown processing of the file /gasmark/phCVE-2026-200904.8A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with administrative privileCVE-2026-200914.8A vulnerability in the web-based management interface of Cisco FXOS Software and Cisco UCS Manager Software could allow an authenticated, reCVE-2026-200926.0A vulnerability in the read-only maintenance shell of Cisco Intersight Virtual Appliance could allow an authenticated, local attacker with aCVE-2026-200939.8A vulnerability in the change password functionality of Cisco Integrated Management Controller (IMC) could allow an unauthenticated, remote CVE-2026-200948.8A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with read-only privileges t
CVE-2026-20083: Medium severity, CVSS 6.5 | Vulnix