Technical details for a maximum severity flaw in Cisco IOS XE WLC, which allows arbitrary file upload and is tracked as CVE-2025-20188, have been made public, bringing us closer to a fully functional exploit.
See also: Cisco patches high-severity DoS vulnerability
The Horizon3 researchers' analysis does not include a ready-made remote code execution (RCE) script , but it provides enough information for a skilled attacker or even a large language model (LLM) to fill in the gaps.
Due to the immediate risk of weaponization and mass exploitation of the vulnerability, affected users are advised to take immediate steps to protect their systems. Cisco disclosed this critical flaw in IOS XE software for Wireless LAN Controllers on May 7, 2025, which could allow an attacker to take complete control of the device.
The company said the cause is a hard-coded JSON Web Token (JWT), which allows an unauthorized, remote user to upload files, perform path traversal, and execute arbitrary commands with root privileges.
The security bulletin stated that the CVE-2025-20188 vulnerability is only dangerous when the “Out-of-Band AP Image Download” is enabled on the device. In this case, the following types of devices are at risk:
- Catalyst 9800-CL Wireless Controllers for Cloud
- Catalyst 9800 Embedded Wireless Controller for Catalyst 9300, 9400, and 9500 series switches
- Catalyst 9800 Series Wireless Controllers
- Embedded Wireless Controller in Catalyst APs
Horizon3's analysis shows that the vulnerability arises due to the use of a hardcoded JWT fallback secret (“notfound”) by the backend Lua scripts that manage the upload points, combined with insufficient path validation.
See also: Cisco fixes 35 vulnerabilities in various products
Specifically, the backend uses OpenResty (Lua + Nginx) scripts to validate JWT tokens and handle file uploads. However, if the '/tmp/nginx_jwt_key' file is missing, the script uses the fixed string “notfound” as an alternative secret to verify JWTs. This effectively allows attackers to generate valid JWT tokens without knowing any secret, simply by using the 'HS256' algorithm and the 'notfound' keyword .
In the Horizon3 example, an HTTP POST with a file upload is sent to the endpoint '/ap_spec_rec/upload/' on port 8443, and path traversal is used on the file name to place a seemingly innocent file (e.g. foo.txt) outside the intended directory.
To escalate the file upload vulnerability to remote code execution (RCE), an attacker can: replace configuration files loaded by backend services, upload web shells, or exploit files monitored by the system to cause unauthorized actions.
In the same example, the 'pvp.sh' service is abused , which monitors specific directories, modifies the configuration files it uses, and triggers a reload, allowing the attacker to execute commands.
Due to the increased risk of exploitation, it is strongly recommended to upgrade to a patched version, such as 17.12.04 or later, as soon as possible. As a temporary measure, administrators can disable the Out-of-Band AP Image Download featureto disable the vulnerable service.
See also: Quantum Networking: Cisco presents innovative chip and new laboratory
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
This incident highlights the importance of secure-by-default software design, and the need to continually inspect and update both the underlying software (firmware) and security procedures. If an upgrade cannot be implemented immediately, even temporarily disabling unsafe functions can make a difference in preventing an attack.
Source: bleepingcomputer
