Hard-Coded JWT Bug in Cisco IOS XE Allows Root RCE on Wireless LAN Controllers
Cisco Fixes Critical IOS XE Wireless Controller Flaw Allowing Remote Root Access
Cisco has patched a maximum severity vulnerability in its IOS XE Software for Wireless LAN Controllers, which could allow unauthenticated remote attackers to fully compromise affected devices. The flaw, identified as CVE-2025-20188, carries a CVSS score of 10.0 and is rooted in the use of a hard-coded JSON Web Token (JWT).
Vulnerability Details
The vulnerability resides in the Out-of-Band AP Image Download feature, which allows Cisco access points (APs) to fetch firmware images via HTTPS, rather than the traditional CAPWAP protocol. The feature, designed to simplify AP provisioning and recovery, includes a hard-coded authentication token, enabling attackers to impersonate legitimate users without credentials.
“An attacker could exploit this vulnerability by sending crafted HTTPS requests to the AP image download interface,” Cisco’s advisory warns.
If successfully exploited, attackers can upload files, perform path traversal, and execute arbitrary commands with root privileges—effectively taking full control of the device.
See Also: So, you want to be a hacker?
Offensive Security, Bug Bounty Courses
Discover your weakest link. Be proactive, not reactive. Cybercriminals need just one flaw to strike.
Affected Devices
Devices vulnerable when the feature is enabled include:
-
Catalyst 9800-CL Wireless Controllers for Cloud
-
Catalyst 9800 Embedded Wireless Controllers for Catalyst 9300, 9400, and 9500
-
Catalyst 9800 Series Wireless Controllers
-
Embedded Wireless Controllers on Catalyst APs
The Out-of-Band AP Image Download feature is disabled by default, but may be enabled in automated or large-scale deployments for efficiency.
Mitigation and Remediation
There are no workarounds or mitigations apart from disabling the feature if it’s not in use. Cisco has released patched firmware for all affected platforms and recommends administrators:
-
Disable the Out-of-Band AP Image Download feature unless strictly required.
-
Apply security updates immediately using the Cisco Software Checker Tool to find the appropriate fixed version.
Scope of Impact
Products not affected by CVE-2025-20188 include:
-
Cisco IOS (non-XE)
-
Cisco IOS XR
-
Cisco Meraki Products
-
Cisco NX-OS
-
Cisco AireOS-based WLCs
As of now, Cisco reports no known in-the-wild exploitation, but given the critical nature and public disclosure, threat actors are expected to begin scanning for vulnerable systems.
Are u a security researcher? Or a company that writes articles about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing? If you want to express your idea in an article contact us here for a quote: [email protected]
Source: bleepingcomputer.com
Recent News
Offensive Security & Ethical Hacking Course
Begin the learning curve of hacking now!
Information Security Solutions
Find out how Pentesting Services can help you.
