CVE-2025-20188

The root cause of the vulnerability is the presence of a hardcoded JWT (JSON Web Token) token in Cisco IOS XE software. An attacker sends crafted HTTPS requests to the AP file upload interface, authenticating using this token without possessing any credentials of their own. Successful exploitation enables uploading arbitrary files to the vulnerable system and performing path traversal to place them in selected file system locations. As a result, it is possible to execute arbitrary commands with root privileges.

An attacker can gain full control of the device — upload malicious files, modify system configuration, and execute arbitrary commands with the highest privileges (root), resulting in complete violation of the device's confidentiality, integrity, and availability.

Apply patches available from the vendor according to the references — detailed information about fixed versions is contained in the official Cisco advisory: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-wlc-file-uplpd-rHZG9UfC. As a temporary workaround, consider restricting access to the AP file upload interface at the network level.

Cisco IOS XE Software for Wireless LAN Controllers (WLC) — versions indicated in the vendor's references (Cisco advisory).