Vulnerability in Cisco iOS Xe Software
CVE-2025-20188
A vulnerability in the Out-of-Band Access Point (AP) Image Download, the Clean Air Spectral Recording, and the client debug bundles features of Cisco IOS XE Software for Wireless LAN Controllers (WLCs) could allow an unauthenticated, remote attacker to upload arbitrary files to an affected system. This vulnerability is due to the presence of a hard-coded JSON Web Token (JWT) on an affected system. An attacker could exploit this vulnerability by sending crafted HTTPS requests to the AP file upload interface. A successful exploit could allow the attacker to upload files, perform path traversal, and execute arbitrary commands with root privileges.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 10.0 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.271 (98.0th percentile), scored .
Moderate probability of exploitation in the next 30 days — watch for active exploitation reports. 98th percentile — 98.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.271 · newest: 0.271 · change: 0.000
Affected products
- Cisco iOS Xe Software — versions 17.11.1, 17.12.1, 17.12.2
- Cisco iOS Xe — versions 17.11.1, 17.11.99sw, 17.12.1
Weakness classification (CWE)
Public proof-of-concept exploits
References
- sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-… (Vendor Advisory)
- 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Exploit, Third Party Advisory)
Frequently asked questions
- What is CVE-2025-20188?
- CVE-2025-20188 is a critical-severity vulnerability in Cisco iOS Xe Software, classified under Use of Hard-coded Credentials. CVSS score: 10.0/10. Published 2025-05-07.
- How severe is CVE-2025-20188?
- Critical severity. CVSS v3 base score is 10.0 out of 10.
- Is CVE-2025-20188 known to be exploited?
- 10 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.