Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
A vulnerability in the Out-of-Band Access Point (AP) Image Download, the Clean Air Spectral Recording, and the client debug bundles features of Cisco IOS XE Software for Wireless LAN Controllers (WLCs) could allow an unauthenticated, remote attacker to upload arbitrary files to an affected system. This vulnerability is due to the presence of a hard-coded JSON Web Token (JWT) on an affected system. An attacker could exploit this vulnerability by sending crafted HTTPS requests to the AP file upload interface. A successful exploit could allow the attacker to upload files, perform path traversal, and execute arbitrary commands with root privileges.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
7 versions affected across 1 product
Technical details about a critical Cisco IOS XE WLC flaw (CVE-2025-20188) are now public, raising the risk of a working exploit emerging soon. Details of a critical vulnerability, tracked as CVE-2025-20188, impacting Ci... https://f.mtr.cool/agzvijlqwx
Post summary
The post announces that technical details of CVE-2025-20188 are now available, highlighting a potential for exploitation in the near future.
7 of 7 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| OS | cisco | ios_xe | 17.11.1 | - | - |
| OS | cisco | ios_xe | 17.11.99sw | - | - |
| OS | cisco | ios_xe | 17.12.1 | - | - |
| OS | cisco | ios_xe | 17.12.2 | - | - |
| OS | cisco | ios_xe | 17.12.3 | - | - |
| OS | cisco | ios_xe | 17.13.1 | - | - |
| OS | cisco | ios_xe | 17.14.1 | - | - |