Back to overview

CVE-2025-20188

CRITICAL Exploitation: PoC
10.0
CVSS 3.1
Description
A vulnerability in the Out-of-Band Access Point (AP) Image Download, the Clean Air Spectral Recording, and the client debug bundles features of Cisco IOS XE Software for Wireless LAN Controllers (WLCs) could allow an unauthenticated, remote attacker to upload arbitrary files to an affected system. This vulnerability is due to the presence of a hard-coded JSON Web Token (JWT) on an affected system. An attacker could exploit this vulnerability by sending crafted HTTPS requests to the AP file upload interface. A successful exploit could allow the attacker to upload files, perform path traversal, and execute arbitrary commands with root privileges.

Metadata

CVE ID
CVE-2025-20188
State
PUBLISHED
Assigner
cisco
Reserved
2024-10-10 19:15 UTC
Published
2025-05-07 17:34 UTC
Last updated
2025-06-06 16:24 UTC
Primary CWE
CWE-798
Use of Hard-coded Credentials
Vendor / Product
Cisco / Cisco IOS XE Software
Sources
cve.org  ·  NVD

Severity & Metrics

10.0 CRITICAL CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
SSVC — CISA Coordinator
Exploitation
PoC
Automatable
yes
Tech. Impact
total
Affected products (1)
VendorProductPlatformVersions
Cisco Cisco IOS XE Software — 17.11.1, 17.12.1, 17.12.2, 17.12.3 …
Weakness (CWE)
CWESourceDescription
CWE-798 cna Use of Hard-coded Credentials
CVSS scores (1)
ScoreSeverityVersionSourceVector
10.0 CRITICAL 3.1 cna CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
References (1)
Back to overview