Cisco has fixed a maximum severity flaw in IOS XE Software for Wireless LAN Controllers by a hard-coded JSON Web Token (JWT) that allows an unauthenticated remote attacker to take over devices. "An attacker could exploit this vulnerability by sending crafted HTTPS requests to the AP image download interface," reads Cisco's bulletin. The 'Out-of-Band AP Image Download' feature allows access points (APs) to download OS images via HTTPS rather than over the CAPWAP protocol, allowing a more flexible and direct way to get firmware onto APs. This token is meant to authenticate requests to a feature called 'Out-of-Band AP Image Download.' Since it's hard-coded, anyone can impersonate an authorized user without credentials. It is noted that CVE-2025-20188 is only exploitable when the 'Out-of-Band AP Image Download' feature is enabled on the device, which isn't enabled by default. Although there are no mitigations or workarounds for CVE-2025-20188, disabling the 'Out-of-Band AP Image Download' feature is a solid defense. On the other hand, products confirmed not to be impacted by the hard-coded JWT issue are: Cisco IOS (non-XE), Cisco IOS XR, Cisco Meraki products, Cisco NX-OS, and Cisco AireOS-based WLCs. Users can determine the exact version that fixes the flaw for their device using the Cisco Software Checker for their specific device model. The vulnerability is tracked as CVE-2025-20188 and has a maximum 10.0 CVSS score, allowing threat actors to fully compromise devices according to the vendor. Cisco has released security updates to address the critical vulnerability, so system administrators are advised to apply them as soon as possible. Bill Toulas Bill Toulas is a tech writer and infosec news reporter with over a decade of experience working on various online publications, covering open-source, Linux, malware, data breach incidents, and hacks. At this time, Cisco is unaware of any cases of active exploitation for CVE-2025-20188.
This Cyber News was published on www.bleepingcomputer.com. Publication date: Thu, 08 May 2025 20:55:08 +0000