A critical vulnerability has been identified in Cisco IOS XE Software's HTTP API subsystem, carrying a high security impact. This flaw allows remote attackers to inject commands with root privileges into the underlying operating system. The vulnerability stems from inadequate input validation within the API. Attackers with administrative credentials can exploit this by making a specially crafted API call. Alternatively, an unauthenticated attacker could deceive an authenticated administrator into clicking a malicious link. A successful exploitation grants the attacker the ability to execute arbitrary commands as root. Cisco has released software updates to rectify this security flaw. Unfortunately, no workarounds are available to mitigate this specific vulnerability. This advisory, identified as CVE-2025-20334, is part of Cisco's September 2025 security publication.