Critical CVE-2025-20188: Unauthenticated RCE in Cisco IOS XE WLCs. Exploits public. Patch immediately or disable Out-of-Band AP Image Download
Continue reading
Technical details revealing how to exploit a maximum-severity vulnerability (CVE-2025-20188) in Cisco IOS XE Wireless LAN Controllers (WLC) have been publicly released, significantly raising the risk of imminent attacks. Horizon3 researchers published a deep dive into the flaw, enabling skilled threat actors—or even advanced AI systems—to weaponize it within hours.
Disclosed by Cisco on May 7, 2025, this 9.8-CVSS vulnerability allows unauthenticated attackers to upload malicious files, traverse directories, and execute arbitrary commands with root privileges. The attack exploits a hardcoded JSON Web Token (JWT) secret (`notfound`) used by Cisco’s OpenResty backend when the `/tmp/nginx_jwt_key` file is missing. Attackers can forge valid tokens to bypass authentication entirely.
Affected Devices:
> Key Trigger: The ‘Out-of-Band AP Image Download’ feature must be enabled for devices to be vulnerable.
Horizon3’s analysis demonstrates how attackers can:
In their example, attackers overwrite configurations monitored by the `pvp.sh` service, triggering a reload to execute malicious payloads with root privileges.
Source: Horizon3 Attack Breakdown
Cisco confirms active exploits are expected within days. Take immediate action:
config t > wireless profile ap-download > no out-of-band ap-image-download enable This flaw transforms a simple file upload into full device takeover. With technical roadmaps now public, unpatched networks face severe ransomware, espionage, and botnet recruitment risks. Cisco administrators must treat this as an emergency patch scenario.
> Update Status: Cisco confirms no public exploits yet, but warns weaponization is imminent. Monitor CVE-2025-20188 Bulletin for updates.
148 malicious npm packages masquerading as student proxy and school Wi-Fi bypass tools. Rather than compromising developers during installation
