CVE-2025-20365 Overview
Cisco disclosed CVE-2025-20365, a medium-severity vulnerability in the IPv6 Router Advertisement (RA) packet processing of Cisco Access Point Software. An unauthenticated, adjacent attacker can modify the IPv6 gateway on an affected device. The flaw stems from a logic error in how the access point processes IPv6 RA packets received from associated wireless clients. Successful exploitation temporarily reroutes the IPv6 gateway and can induce intermittent packet loss for wireless clients associated with the affected access point. The weakness is classified under [CWE-940] Improper Verification of Source of a Communication Channel.
Critical Impact
An attacker associated to the wireless network can send crafted IPv6 RA packets to alter the access point's IPv6 gateway and disrupt connectivity for other wireless clients.
Affected Products
- Cisco Access Point Software (see the Cisco advisory for the list of affected platforms)
- Wireless deployments processing IPv6 Router Advertisement traffic from clients
- Environments with IPv6 enabled on Cisco access points
Discovery Timeline
- 2025-09-24 - CVE-2025-20365 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-20365
Vulnerability Analysis
The vulnerability resides in the IPv6 Router Advertisement processing logic of Cisco Access Point Software. IPv6 hosts use RA messages sent by routers to learn on-link prefixes and default gateway information. The access point does not properly validate the source of RA packets received on the wireless interface. Because clients associated to a Wi-Fi network are not legitimate sources of RA messages, accepting them constitutes a trust boundary violation. An attacker exploits this by joining the wireless network and transmitting crafted RA packets. The access point then updates its own IPv6 gateway based on attacker-supplied data. The result is temporary gateway reassignment on the access point and intermittent IPv6 packet loss for wireless clients relying on the device. The issue does not enable code execution or persistent configuration changes, but it disrupts availability of upstream IPv6 connectivity.
Root Cause
The root cause is a logic error [CWE-940] in the RA packet handler. The access point fails to distinguish RA messages originating from trusted upstream routers from those injected by wireless clients. Layer 2 protections such as RA Guard, which normally block rogue RA messages on access ports, are not enforced by the vulnerable code path.
Attack Vector
The attack vector is adjacent network. The attacker must associate to a wireless network served by the affected access point. Once associated, the attacker sends a series of crafted ICMPv6 Router Advertisement packets sourced from a link-local address. The access point processes these RAs and modifies its IPv6 gateway. No authentication or user interaction beyond wireless association is required. The impact is limited to integrity of routing state on the access point and availability of IPv6 traffic for associated clients.
No public exploit code or proof-of-concept has been published. Refer to the Cisco Security Advisory for platform-specific technical details.
Detection Methods for CVE-2025-20365
Indicators of Compromise
- Unexpected ICMPv6 Router Advertisement packets (ICMPv6 type 134) sourced from wireless client MAC or link-local addresses.
- Sudden changes to the IPv6 default gateway or on-link prefix table on Cisco access points.
- Intermittent IPv6 packet loss reports from wireless clients associated to a specific access point.
- Wireless client sessions correlating with the appearance of anomalous RA traffic on the SSID.
Detection Strategies
- Enable IPv6 RA Guard on wired and wireless access-layer devices to identify and drop RA messages arriving from client-facing interfaces.
- Ingest access point syslog and IPv6 neighbor discovery logs into a SIEM and alert on gateway or prefix changes.
- Correlate wireless association events with ICMPv6 type 134 packets originating from client addresses.
Monitoring Recommendations
- Monitor access point control-plane logs for IPv6 gateway modifications outside of maintenance windows.
- Track client-reported IPv6 connectivity failures and correlate them with wireless association timelines.
- Baseline expected RA sources (upstream routers) and alert on any RA seen from unauthorized MAC addresses.
How to Mitigate CVE-2025-20365
Immediate Actions Required
- Review the Cisco Security Advisory and identify affected access point models and software versions in your environment.
- Apply the fixed Cisco Access Point Software release as soon as it is available for your platform.
- Enable IPv6 RA Guard on switch ports and wireless controllers where supported.
- Restrict wireless network access with strong authentication (WPA2/WPA3-Enterprise) to reduce the attacker population able to associate.
Patch Information
Cisco has published fixed software in the security advisory. Refer to the Cisco Security Advisory for the specific fixed release train for each affected access point platform. There are no listed workarounds that fully address the issue on unpatched devices.
Workarounds
- Disable IPv6 on affected access points if it is not required for business operations.
- Enforce RA Guard or equivalent first-hop security controls on the wireless infrastructure to filter client-sourced RA packets.
- Segment guest and untrusted wireless networks from IPv6-enabled infrastructure to limit adjacent attack surface.
- Restrict wireless association to authenticated users only, and monitor client behavior for anomalous ICMPv6 traffic.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
