Use of hard-coded credentials in Cisco Systems, Inc products - CVE-2025-20188

Detailed vulnerability description

The vulnerability allows a remote attacker to gain full access to vulnerable system.

The vulnerability exists due to the presence of a hard-coded JSON Web Token (JWT) within the Out-of-Band AP Image Download feature. A remote unauthenticated attacker can send specially crafted HTTPS requests to the AP image download interface and upload arbitrary files to the system. 

Successful exploitation of the vulnerability may result in full system compromise.

How to mitigate CVE-2025-20188

Install updates from vendor's website.

This vulnerability affects the following Cisco products if they are running a vulnerable release of Cisco IOS XE Software for WLCs and have the Out-of-Band AP Image Download feature enabled:

• Catalyst 9800-CL Wireless Controllers for Cloud
• Catalyst 9800 Embedded Wireless Controller for Catalyst 9300, 9400, and 9500 Series Switches
• Catalyst 9800 Series Wireless Controllers
• Embedded Wireless Controller on Catalyst APs

Sources

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-wlc-file-uplpd-rHZG9UfC
• https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwk33139