In early May 2025, Cisco released software fixes to address a flaw in its IOS XE Software for Wireless LAN Controllers (WLCs). The vulnerability, tracked as CVE-2025-20188, has a CVSS score of 10.0 and could enable an unauthenticated, remote attacker to upload arbitrary files to a susceptible system – but the real story is that this vulnerability drives home the persistent risks associated with hardcoded credentials, particularly JSON Web Tokens (JWTs), in network infrastructure components. In this blog post, we’ll explore CVE-2025-20188, the concerning trend of hardcoded JWT secrets, and how Wallarm can help prevent these kinds of issues. What is CVE-2025-20188? CVE-2025-20188 is a critical vulnerability in the Out-of-Band Access Point (AP) Image Download feature of Cisco IOS XE Software for WLCs. The core issue lies in a hardcoded JWT – a predictable, reusable authentication key – embedded within the software. Attackers could exploit this vulnerability by sending API requests using this hardcoded key to the AP image download interface. If successful, they could upload any files they want to the system, navigate to areas they shouldn’t (a technique known as path traversal), and even execute commands with full administrator (root) privileges. However, it is important to note that the vulnerable Out-of-Band AP Image Download feature is disabled by default, meaning this is only a risk if someone has manually turned this feature on. CVE-2025-20188's Potential Impact As…Read More