CISCO FIXES MAX SEVERITY IOS XE FLAW LETTING ATTACKERS HIJACK DEVICES

Summary from the TLDR InfoSec newsletter

Cisco has released fixes for a maximum severity (10.0 CVSS score) vulnerability affecting IOS XE Software for Wireless LAN Controllers. The devices utilize a hardcoded JWT that could allow unauthenticated attackers to exploit the AP image download interface to upload files, perform path traversal, or execute arbitrary code. Only devices with the “Out-of-Band AP Image Download” feature, which allows APs to download AP's OS images via HTTPS, are vulnerable.