{"basis":"claimed","id":"CVE-2025-20188","name":"Cisco Cisco IOS XE Software","vendorProject":"Cisco","product":"Cisco IOS XE Software","publishedAt":"2025-05-07","cvss":{"score":10,"severity":"CRITICAL","version":"3.1"},"exploited":null,"epss":{"score":0.27488,"percentile":0.98073,"date":"2026-11-02"},"coverage":{"cloudflare":{"status":"blocks","firstOn":"2025-06-16","daysToRule":40},"aws":{"status":"none","firstOn":null,"daysToRule":null},"azure":{"status":"none","firstOn":null,"daysToRule":null},"google":{"status":"none","firstOn":null,"daysToRule":null},"fastly":{"status":"no_history","firstOn":null,"daysToRule":null},"f5":{"status":"rule","firstOn":"2025-08-15","daysToRule":100},"akamai":{"status":"no_source","firstOn":null,"daysToRule":null},"crs":{"status":"none","firstOn":null,"daysToRule":null}},"title":null,"description":"A vulnerability in the Out-of-Band Access Point (AP) Image Download, the Clean Air Spectral Recording, and the client debug bundles features of Cisco IOS XE Software for Wireless LAN Controllers (WLCs) could allow an unauthenticated, remote attacker to upload arbitrary files to an affected system.\r\n\r This vulnerability is due to the presence of a hard-coded JSON Web Token (JWT) on an affected system.  An attacker could exploit this vulnerability by sending crafted HTTPS requests to the AP file upload interface. A successful exploit could allow the attacker to upload files, perform path traversal, and execute arbitrary commands with root privileges.","cwes":["CWE-798"],"vendors":[{"vendor":"cloudflare","status":"blocks","basis":"claimed","firstOn":"2025-06-16","firstIsNew":true,"daysToRule":40,"daysAtMost":null,"freePlan":false,"claims":[{"id":"e334a179d662bf3f8475813f7c55c5e03813d8cc14747a2320ad311c44cde3a8","cve_id":"CVE-2025-20188","vendor":"cloudflare","product":"Cloudflare Managed Ruleset","rule_id":"233bcf0ce50f400989a7e44a35fefd53","rule_name":"Cisco IOS XE - Remote Code Execution - CVE:CVE-2025-20188","change":"new","default_action":"Block","published_on":"2025-06-16","source_url":"https://developers.cloudflare.com/changelog/post/2025-06-16-waf-release/","source_title":"WAF Release - 2025-06-16","excerpt":"Cisco IOS XE - Remote Code Execution - CVE:CVE-2025-20188. Previous action: Log. New action: Block. This is a New Detection","first_seen_at":"2026-11-02T21:00:16.350Z"}]},{"vendor":"aws","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"azure","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"google","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"fastly","status":"no_history","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"f5","status":"rule","basis":"claimed","firstOn":"2025-08-15","firstIsNew":true,"daysToRule":100,"daysAtMost":null,"freePlan":false,"claims":[{"id":"a485015da4e6af88a4860bdc9b9e9db85e21dbd1339231dd69d8424173a8e657","cve_id":"CVE-2025-20188","vendor":"f5","product":"Attack signatures","rule_id":"200007097","rule_name":"Cisco IOS XE WLC Arbitrary File Upload (1)","change":"new","default_action":null,"published_on":"2025-08-15","source_url":"https://docs.cloud.f5.com/docs-v2/platform/changelogs/security-details-changelog","source_title":"F5 Distributed Cloud attack signatures changelog","excerpt":"Added: signature 200007097 \"Cisco IOS XE WLC Arbitrary File Upload (1)\" (Path Traversal, risk High), systems: Cisco. References: CVE-2025-20188.","first_seen_at":"2026-11-02T21:00:25.702Z"},{"id":"d83499ecf0544780d6efe531a6d2cf10667cd950172346f7a0f790f21e8f1a46","cve_id":"CVE-2025-20188","vendor":"f5","product":"Attack signatures","rule_id":"200007098","rule_name":"Cisco IOS XE WLC Arbitrary File Upload (2)","change":"new","default_action":null,"published_on":"2025-08-15","source_url":"https://docs.cloud.f5.com/docs-v2/platform/changelogs/security-details-changelog","source_title":"F5 Distributed Cloud attack signatures changelog","excerpt":"Added: signature 200007098 \"Cisco IOS XE WLC Arbitrary File Upload (2)\" (Path Traversal, risk High), systems: Cisco. References: CVE-2025-20188.","first_seen_at":"2026-11-02T21:00:25.702Z"}]},{"vendor":"akamai","status":"no_source","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"crs","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]}],"updatedAt":"2026-11-02T21:16:34.613Z","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","ssvc":{"exploitation":"poc","automatable":"yes","technicalImpact":"total"},"measured":[{"engineId":"owasp-crs","engineName":"OWASP Core Rule Set","engineVersion":"4.25.0","runtime":"Coraza v3.8.1","config":"paranoia level 1, anomaly threshold 5, default CRS settings","ranAt":"2026-11-02T13:02:57.000Z","verdict":"partial","templateId":"CVE-2025-20188","templatePath":"http/cves/2025/CVE-2025-20188.yaml","requests":3,"blockedRequests":2,"rules":["930100","930110"],"note":"","requestDetail":[{"method":"POST","path":"/ap_spec_rec/upload/","status":403,"blocked":true,"rules":["930110"]},{"method":"POST","path":"/ap_spec_rec/upload/","status":403,"blocked":true,"rules":["930100","930110"]},{"method":"GET","path":"/x.txt","status":200,"blocked":false,"rules":[]}]},{"engineId":"owasp-crs","engineName":"OWASP Core Rule Set","engineVersion":"4.25.0","runtime":"Coraza v3.8.1","config":"paranoia level 2, anomaly threshold 5, default CRS settings","ranAt":"2026-11-02T13:03:28.000Z","verdict":"partial","templateId":"CVE-2025-20188","templatePath":"http/cves/2025/CVE-2025-20188.yaml","requests":3,"blockedRequests":2,"rules":["930100","930110"],"note":"","requestDetail":[{"method":"POST","path":"/ap_spec_rec/upload/","status":403,"blocked":true,"rules":["930110"]},{"method":"POST","path":"/ap_spec_rec/upload/","status":403,"blocked":true,"rules":["930100","930110"]},{"method":"GET","path":"/x.txt","status":200,"blocked":false,"rules":[]}]}],"social":{"total":0,"first_seen":null,"daily":[{"day":"2026-10-21","posts":0},{"day":"2026-10-22","posts":0},{"day":"2026-10-23","posts":0},{"day":"2026-10-24","posts":0},{"day":"2026-10-25","posts":0},{"day":"2026-10-26","posts":0},{"day":"2026-10-27","posts":0},{"day":"2026-10-28","posts":0},{"day":"2026-10-29","posts":0},{"day":"2026-10-30","posts":0},{"day":"2026-10-31","posts":0},{"day":"2026-11-01","posts":0},{"day":"2026-11-02","posts":0},{"day":"2026-11-03","posts":0}],"top_posts":[],"exploit_repositories":[]}}