CVE-2025-20188
Published: 07 May 2025
Summary
CVE-2025-20188 is a critical-severity Use of Hard-coded Credentials (CWE-798) vulnerability in Cisco Ios Xe. Its CVSS base score is 10.0 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Ingress Tool Transfer (T1105); ranked in the top 10.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
A vulnerability in the Out-of-Band Access Point (AP) Image Download, Clean Air Spectral Recording, and client debug bundles features of Cisco IOS XE Software for Wireless LAN Controllers (WLCs) could allow an unauthenticated, remote attacker to upload arbitrary files. The issue stems from a hard-coded JSON Web Token (JWT) present on affected systems and is tracked as CWE-798. Successful exploitation enables file uploads via the AP file upload interface, path traversal, and execution of arbitrary commands with root privileges. The flaw carries a CVSS 3.1 score of 10.0.
An unauthenticated remote attacker can exploit the vulnerability by sending crafted HTTPS requests to the AP file upload interface. This grants the ability to upload files, traverse directories, and run commands at root level on the controller, potentially leading to full system compromise.
The Cisco Security Advisory at sec.cloudapps.cisco.com recommends applying the fixes listed for the affected IOS XE releases and disabling or restricting access to the impacted features where possible. Additional technical analysis is available from Horizon3.
EPSS remains low at 0.0462 with no material increase from its peak, indicating limited observed exploitation interest to date.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-13907
Vulnerability details
A vulnerability in the Out-of-Band Access Point (AP) Image Download, the Clean Air Spectral Recording, and the client debug bundles features of Cisco IOS XE Software for Wireless LAN Controllers (WLCs) could allow an unauthenticated, remote attacker to upload arbitrary…
more
files to an affected system. This vulnerability is due to the presence of a hard-coded JSON Web Token (JWT) on an affected system. An attacker could exploit this vulnerability by sending crafted HTTPS requests to the AP file upload interface. A successful exploit could allow the attacker to upload files, perform path traversal, and execute arbitrary commands with root privileges.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability enables unauthenticated arbitrary file upload (T1105: Ingress Tool Transfer), path traversal, and root command execution on a network device (T1059.008: Network Device CLI) via exploitation of a public-facing web interface (T1190: Exploit Public-Facing Application).
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Enables users to notice when hard-coded credentials have been exploited for unauthorized access.
Security training explicitly warns against hard-coded credentials, lowering their use in systems.
Policy and procedures prohibit hard-coded credentials in favor of managed authentication.
External identity providers eliminate the need for hard-coded credentials in applications.
Changing default authenticators prior to first use and protecting content prevents use of hard-coded credentials.
Central credential stores and rotation policies remove the need for hard-coded credentials in configuration files or code.
Intelligence programs surface reports of campaigns that abuse hard-coded credentials in products, prompting removal or replacement and thereby reducing successful exploitation.
Planned investment enables secure credential storage and management systems instead of hard-coded credentials.