EXPLOIT DETAILS FOR MAX SEVERITY CISCO IOS XE FLAW NOW PUBLIC

Summary from the TLDR InfoSec newsletter

Cisco disclosed vulnerabilities (CVE-2025-20188) in IOS XE for Catalyst Wireless Controllers and APs. The vendor indicated that a hard-coded JSON Web Token (JWT) allows unauthenticated remote attackers to upload files, perform path traversal, and execute commands with root privileges. CVE-2025-20188 is only dangerous if the 'Out-of-Band AP Image Download' feature is enabled on the Wireless Controllers.