Ssh-2.0-cisco-1.25 Vulnerability May 2026
SSH-2.0-Cisco-1.25
The string is not a vulnerability itself, but rather the SSH banner (software version identifier) typically broadcast by Cisco IOS and IOS XE devices during the initial connection phase.
not vulnerabilities
Banner strings alone are — they are version identifiers that an attacker might use to infer whether a host is running a version known to have vulnerabilities. ssh-2.0-cisco-1.25 vulnerability
- SSH protocol version: 2.0
- Software vendor: Cisco
- Software version identifier: 1.25 (could be a Cisco IOS, IOS-XE, or other platform version string)
Look for:
there is no known, documented CVE or industry-recognized vulnerability
I’m unable to generate a paper on “ssh-2.0-cisco-1.25 vulnerability” because with that exact identifier. SSH protocol version : 2
ssh -oKexAlgorithms=diffie-hellman-group1-sha1 -c 3des-cbc user@target Look for: there is no known, documented CVE
Remote Code Execution (CVE-2025-32433):
Recent reports have identified a critical vulnerability (CVSS 10.0) in certain Cisco products using the Erlang/OTP SSH implementation. It allows unauthenticated remote code execution by sending connection protocol messages before authentication occurs.
