Skip to content
Hermes Codex

CVE-2025-20188: Arbitrary File Upload and Root RCE in Cisco IOS XE WLC via Hard-Coded JWT

HERMES

HERMES THREAT SCORE & WIRELESS INFRASTRUCTURE CONTROLLER

Target: Cisco Catalyst 9800 Wireless Controller (Cisco IOS XE)
Confidence: 99%
96 / 100
CRITICAL

Measures real-world operational relevance, exploit weaponization, and active threat posture.

Dimension Breakdown
Exploitability 20 / 20
Threat Activity 17 / 20
Weaponization 20 / 20
Exposure 18 / 20
Prevalence 19 / 20
Impact 20 / 20
Exploit Maturity 19 / 20
Attack Chain Potential 20 / 20
⚖️ Divergence & Operational Rationale

Hermes evaluates CVE-2025-20188 at an HTS of 96 (CRITICAL). This flaw carries a CVSS base score of 10.0. The presence of a hardcoded cryptographic secret in libewlc_apmgr.so combined with unvalidated path traversal in ewlc_jwt_upload_files.lua allows remote attackers to upload arbitrary binaries and achieve root remote code execution without authentication.

🕸️ Connected Knowledge Graph & Provenance

CVE-2025-20188: Arbitrary File Upload and Root RCE in Cisco IOS XE WLC via Hard-Coded JWTVULNERABILITY

Connected Nodes: 1
Active Relationships (Outgoing)
→ usesATTACK TECHNIQUET1059: Command and Scripting Interpreter
90% VERY_HIGH

Adversaries abuse command and script interpreters (Bash, Python, PowerShell) to execute arbitrary commands.

🔍 Why is this related? (Evidence & Provenance)

“Attack execution telemetry aligns with MITRE ATT&CK technique T1059.”

Supporting Verified Evidence:

1. Identification

Section titled “1. Identification”
ParameterTechnical SpecificationOperational Impact
CVE IdentifierCVE-2025-20188Cisco Security Advisory cisco-sa-wlc-file-uplpd-rHZG9UfC
Associated CWEsCWE-798 (Hard-coded Credentials) & CWE-22 (Path Traversal)Predictable JWT signature and directory escape
CVSS v3.1 Score10.0 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Applicable CPEscpe:2.3:o:cisco:ios_xe:*:*:*:*:*:*:*:*Catalyst 9800 Series Wireless Controllers
Affected Versions17.3, 17.6, 17.9 (< 17.9.6a), 17.12 (< 17.12.4)Deployments with TCP port 8443 reachable
Fixed Versions17.9.6a, 17.12.4, 17.13.1aOfficial vendor software upgrades

2. Exploitation

Section titled “2. Exploitation”
  • EPSS Score: 0.27136 (Percentile: 97.9%).
  • Technical Attack Chain:
    1. The Out-of-Band AP image download and spectral recording feature exposes an OpenResty web listener on port 8443.
    2. Client authentication relies on a JWT signed with a static fallback secret hardcoded in /usr/binos/lib64/libewlc_apmgr.so.
    3. An attacker generates a valid token and issues a multipart POST request with a path traversal payload (filename="../../usr/binos/openresty/nginx/html/payload").
    4. Automatic reloading mechanisms managed by pvp.sh trigger execution of the dropped binary as root.
  • Authentication: Zero authentication required (PR:N).

3. Detection and Forensics

Section titled “3. Detection and Forensics”

Sigma Rule

Section titled “Sigma Rule”
title: Cisco WLC Suspicious OpenResty File Upload (CVE-2025-20188)
id: 20188-cisco-wlc-file-upload-en
status: production
description: Detects suspicious POST requests with directory traversal characters on Cisco WLC management port 8443.
logsource:
  category: webserver
  product: cisco_ios_xe
detection:
  selection_port:
    destination_port: 8443
  selection_traversal:
    cs-uri-stem|contains:
      - '..'
      - '%2e%2e'
  condition: selection_port and selection_traversal
level: critical

MITRE ATT&CK

Section titled “MITRE ATT&CK”
  • T1190: Exploit Public-Facing Application
  • T1059.004: Unix Shell
  • T1078: Valid Accounts

4. Remediation and Hardening

Section titled “4. Remediation and Hardening”
  1. Apply Software Upgrade: Upgrade controllers to Cisco IOS XE 17.9.6a, 17.12.4, or later releases.
  2. Configuration Workaround: Disable the out-of-band AP image download feature using CLI: no ap image-download.
  3. ACL Hardening: Restrict network access to port 8443 via perimeter firewalls or Control Plane Protection (CoPP).

5. Enterprise Exploitation Scenario

Section titled “5. Enterprise Exploitation Scenario”

« What happens if this vulnerability is exploited in an enterprise? »

Section titled “« What happens if this vulnerability is exploited in an enterprise? »”
  1. Perimeter Appliance Infiltration: An unauthenticated attacker connects to port 8443 on the corporate Catalyst 9800 wireless controller and transmits a forged JWT along with an arbitrary binary payload.
  2. Root Shell Acquisition: The appliance processes the upload, escapes the destination directory, and spawns an interactive root shell on the underlying Linux host.
  3. Wireless Traffic Interception: Positioned at the core of the enterprise Wi-Fi architecture, the attacker captures wireless traffic, steals RADIUS shared secrets, and decrypts enterprise network communications.
  4. Cross-VLAN Lateral Movement: The attacker utilizes the compromised controller to pivot directly into management networks and sensitive corporate VLANs.