CVE-2025-20188: Path Traversal
First published: Wed May 07 2025(Updated: )
A vulnerability in the Out-of-Band Access Point (AP) Image Download feature of Cisco IOS XE Software for Wireless LAN Controllers (WLCs) could allow an unauthenticated, remote attacker to upload arbitrary files to an affected system. This vulnerability is due to the presence of a hard-coded JSON Web Token (JWT) on an affected system. An attacker could exploit this vulnerability by sending crafted HTTPS requests to the AP image download interface. A successful exploit could allow the attacker to upload files, perform path traversal, and execute arbitrary commands with root privileges. Note: For exploitation to be successful, the Out-of-Band AP Image Download feature must be enabled on the device. It is not enabled by default.
Credit: psirt@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco IOS XE |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2025-20188?
CVE-2025-20188 has been classified as critical due to the risk of remote file uploads by unauthenticated attackers.
How do I fix CVE-2025-20188?
To fix CVE-2025-20188, ensure that you upgrade to the latest version of Cisco IOS XE Software that is not vulnerable.
What systems are affected by CVE-2025-20188?
CVE-2025-20188 affects Cisco IOS XE Software operating on Wireless LAN Controllers.
Can CVE-2025-20188 be exploited remotely?
Yes, CVE-2025-20188 can be exploited by an unauthenticated remote attacker.
What are the potential impacts of CVE-2025-20188?
The potential impacts of CVE-2025-20188 include unauthorized file uploads, which could lead to further compromise of affected systems.
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/first-publish-date
- agent/description
- agent/type
- agent/guess-ai
- agent/software-canonical-lookup
- agent/softwarecombine
- agent/author
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- collector/bleeping-computer
- source/BleepingComputer
- alias/CVE-2025-20188
- agent/news-ai
- agent/source
- agent/references
- agent/severity
- agent/tags
- agent/event
- agent/trending
- vendor/cisco
- canonical/cisco ios xe