{"id":"CVE-2025-20188","published":"2025-05-07T17:34:36Z","modified":"2025-06-06T16:24:05Z","title":"A vulnerability in the Out-of-Band Access Point (AP) Image Download, the Clean Air Spectral Recording, and the client…","vendor":"Cisco","product":"Cisco IOS XE Software","tier":"core","eol":null,"affectedVersions":[{"vendor":"Cisco","product":"Cisco IOS XE Software","versions":["17.11.1","17.12.1","17.12.2","17.12.3","17.13.1","17.14.1","17.11.99SW"]}],"description":{"text":"A vulnerability in the Out-of-Band Access Point (AP) Image Download, the Clean Air Spectral Recording, and the client debug bundles features of Cisco IOS XE Software for Wireless LAN Controllers (WLCs) could allow an unauthenticated, remote attacker to upload arbitrary files to an affected system.\r\n\r This vulnerability is due to the presence of a hard-coded JSON Web Token (JWT) on an affected system.  An attacker could exploit this vulnerability by sending crafted HTTPS requests to the AP file upload interface. A successful exploit could allow the attacker to upload files, perform path traversal, and execute arbitrary commands with root privileges.","provenance":"source","from":"CVE.org"},"summary":{"text":"A hard-coded JSON Web Token in Cisco IOS XE Software for Wireless LAN Controllers affects the Out-of-Band Access Point (AP) Image Download, Clean Air Spectral Recording, and client debug bundles features. An unauthenticated remote attacker who sends crafted HTTPS requests to the AP file upload interface can upload arbitrary files, perform path traversal, and execute arbitrary commands with root privileges, with no user interaction required.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-31T04:54:46Z"},"cvss":{"score":10,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.27488,"percentile":0.9807,"date":"2026-10-30","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2025-06-10","exploitedFirstSeen":"2025-06-10","ransomware":false,"evidence":[{"url":"https://cyble.com/blog/weekly-cyble-vulnerability-blog/","date":"2025-06-10"},{"url":"https://cyble.com/blog/vulnerabilities-under-attack/","date":"2025-09-23"},{"url":"https://www.enisa.europa.eu/sites/default/files/2025-10/ENISA%20Threat%20Landscape%202025.pdf","date":"2025-10-09"}],"evidenceTotal":3,"provenance":"source"},"exploited":true,"otx":{"pulseCount":3,"pulses":[{"name":"CVE Data","url":"https://otx.alienvault.com/pulse/69929b597293fe5837b9c95c","created":"2026-02-16"},{"name":"BADBOX 2.0 Botnet Hijacks 1 Million+ Devices in Global IoT Supply-Chain Attack","url":"https://otx.alienvault.com/pulse/684438deb269323d7e1aba3d","created":"2025-06-07"},{"name":"New Chaos RAT Variants Threaten Windows and Linux Systems with Stealthy Data Theft","url":"https://otx.alienvault.com/pulse/6843300336b121603e3cffad","created":"2025-06-06"}],"provenance":"machine"},"cwes":[{"id":"CWE-798","name":"Use of Hard-coded Credentials"}],"references":[{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-wlc-file-uplpd-rHZG9UfC","tags":[]},{"url":"https://horizon3.ai/attack-research/attack-blogs/cisco-ios-xe-wlc-arbitrary-file-upload-vulnerability-cve-2025-20188-analysis/","tags":["exploit"]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2025-13907","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-13907","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"nuclei":[{"id":"CVE-2025-20188","name":"Cisco IOS XE WLC - Arbitrary File Upload","severity":"critical","path":"http/cves/2025/CVE-2025-20188.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-20188.yaml"}],"provenance":"source"},"exploitRefs":["https://horizon3.ai/attack-research/attack-blogs/cisco-ios-xe-wlc-arbitrary-file-upload-vulnerability-cve-2025-20188-analysis/"],"flow":[],"timeline":[{"date":"2025-05-07","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2025-20188","provenance":"source"},{"date":"2025-06-10","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://cyble.com/blog/weekly-cyble-vulnerability-blog/","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":68.0,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 508 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.61,"detail":"percentile 0.9807"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":1.37,"detail":"3 pulses"},{"name":"CVSS severity","points":7.0,"detail":"base score 10"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}