Skip to main content
Live Webinar with SANS (June 25)— Agentic CTI Automation for Fun & ProfitRegister Free
Mallory
CriticalPublic exploit

Unauthenticated Arbitrary File Upload and Root RCE in Cisco IOS XE Wireless LAN Controllers

IdentifiersCVE-2025-20188CWE-798· Use of Hard-coded Credentials

CVE-2025-20188 is a critical vulnerability in Cisco IOS XE Software for Wireless LAN Controllers (WLCs) affecting the Out-of-Band Access Point (AP) Image Download, Clean Air Spectral Recording, and client debug bundles functionality. The issue is caused by the presence of a hard-coded JSON Web Token (JWT) used by the AP file upload interface. Because the token is embedded in the affected system, a remote unauthenticated attacker can craft valid HTTPS requests to the upload interface and bypass intended authorization checks. Successful exploitation allows arbitrary file upload; due to insufficient path validation, the issue can also be leveraged for path traversal, enabling placement of files outside the intended directory. Cisco and supporting reporting indicate this can be chained to arbitrary command execution with root privileges on the affected controller.

Share:
For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation can result in full compromise of the affected WLC. An unauthenticated remote attacker can upload arbitrary files, write files to attacker-chosen paths via traversal, and execute arbitrary commands as root. This provides complete device takeover and can enable persistent backdoors or malicious scripts, configuration tampering, traffic monitoring or rerouting, disruption of wireless network operations, and lateral movement from the controller into adjacent enterprise infrastructure.

Mitigation

If you can’t patch tonight, do this now.

If immediate patching is not possible, disable the Out-of-Band AP Image Download feature. Cisco states exploitation requires this feature to be enabled and that it is not enabled by default. Disabling it forces AP image transfer back to CAPWAP and removes the vulnerable attack surface, though operators should assess operational impact for APs that rely on HTTPS-based image download. Additional short-term defensive measures mentioned in supporting reporting include restricting access to affected HTTPS endpoints and monitoring for suspicious JWT use and unexpected file uploads, but patching or disabling the feature is the primary mitigation.

Remediation

Patch, then assume compromise.

Apply Cisco’s fixed IOS XE Software release for affected Wireless LAN Controllers. Cisco has released software updates to address CVE-2025-20188; organizations should use Cisco’s Software Checker and vendor advisory to identify affected versions and upgrade paths. Because the vulnerability is rooted in a hard-coded JWT, remediation requires installing a patched software version rather than credential rotation or token replacement.
PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType
Cisco SystemsIos Xeoperating_system

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.
Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity83

Community discussion across Reddit, Mastodon, and other social sources.