Discrepancy between the Cisco security advisory cisco-sa-c2960-3560-sb

[dor-b]

I am confused by the discrepancy between the Cisco security advisory cisco-sa-c2960-3560-sboot-ZtqADrHq and the bug report CSCvd75918.

The advisory lists the vulnerable products as Catalyst 2960X, 2960XR, 2960CX, and 3560CX Series Switches. However, the bug ID mentions Catalyst 9200, 9300, 9400, 9500, and 9600 Series Switches.

Could you please clarify which Cisco Catalyst models and versions are actually affected by this issue?

[Kasun Bandara]

@dor-b hi, seems like mistake on the bug update. looks like this is affecting to '

2960X, 2960XR, 2960CX, and 3560CX'

[M02@rt37]

Hello @dor-b 

The c9200, 9300, 9400, 9500, and 9600 series switch are not listed as afected products in the official advisory for CVE-2025-20181. For this particular secure boot bypass vulnerability, only the 2960X/2960XR/2960CX and 3560CX models should be considered impacted.

[Jens Albrecht]

Hi @dor-b,

unfortunately such documentation errors happen from time to time.

So I always double-check such issues with other tools like Cisco Software Checker which are more reliable in most cases:

Then it becomes clear that in fact the Catalyst 2960X, 2960XR, 2960CX, and 3560CX Series Switches are affected and the vulnerability got fixed in the meantime.

HTH!

[dor-b]

Thanks to everyone who answered. I'd be happy if someone could clarify, what is the best way to track vulnerable products? Look only at advisories? Look only at the checker? Both?

[dor-b]

In general, not specifically this case

[M02@rt37 · Accepted solution]

Hello @dor-b 

in practice... use advisories for awarness and undestanding, and Sotware Checker for validation and operational "decision-making".

Addistionaly, if you aware about that, you could integrate an open datat feeds that can help you to automate vulnerability tracking accros your network..

[Jens Albrecht]

Tracking the security advisories is easy so this is typically the preferred way to get notified about new vulnerabilities.

Then, if a customer decides to take action based on an advisory or in case of unclear/contradictory information like this one, it is best practice to use additional tools like the Software Checker and also check the release notes of the latest version to verify that the vulnerability got in fact closed.

Finally, the new version needs to be tested in a POC lab before getting implemented in the production network, even though I know quite a few customers that ignore this important step to save a few bucks.