Cisco IOS XE Software - Hardcoded Credentials (CVE-2025-20188)

CVE-2025-20188 is a critical vulnerability in Cisco IOS XE Software for Wireless LAN Controllers, impacting the Out-of-Band AP Image Download feature. It enables unauthenticated remote attackers to upload arbitrary files due to the use of a hard-coded token, potentially leading to command execution with root privileges if the vulnerable feature is enabled.

CrowdSec has been tracking this vulnerability and its exploits since 6th of June 2025.

Insights from the CrowdSec network reveal that the attackers trying to exploit CVE-2025-20188 are composed of a fairly even mix of opportunistic and targeted actors. Some attackers employ preliminary reconnaissance, while others use indiscriminate scanning. CrowdSec data also reveals a clear uptick in attacks involving CVE-2025-20188 over the past week. Activity is above the usual baseline, suggesting growing attention from attackers. This may reflect rising awareness, recent exploit releases, or expanded targeting efforts.

Observed exploitation attempts target URLs containing the path /ap_spec_rec/upload/, and often involve attempts to upload malicious files to compromised devices.