Cisco IOS XE sérülékenysége
Angol cím: Cisco IOS XE Vulnerability
Publikálás dátuma: 2025.05.07.
Utolsó módosítás dátuma: 2025.05.08.
Leírás
A termék hard-coded hitelesítő adatokat, például jelszót vagy kriptográfiai kulcsot tartalmaz.
Leírás forrása: CWE-798Elemzés leírás
Eredeti nyelven: A vulnerability in the Out-of-Band Access Point (AP) Image Download feature of Cisco IOS XE Software for Wireless LAN Controllers (WLCs) could allow an unauthenticated, remote attacker to upload arbitrary files to an affected system. This vulnerability is due to the presence of a hard-coded JSON Web Token (JWT) on an affected system. An attacker could exploit this vulnerability by sending crafted HTTPS requests to the AP image download interface. A successful exploit could allow the attacker to upload files, perform path traversal, and execute arbitrary commands with root privileges.
Elemzés leírás forrása: CVE-2025-20188Hatás
CVSS3.1 Súlyosság és Metrika
Base score: 10.0 (Kritikus)
Vector: AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Impact Score: 6.0
Exploitability Score: 3.9
Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope (S): Changed
Confidentiality Impact (C): High
Integrity Impact (I): High
Availability Impact (A): High
Sérülékeny szoftverek
Catalyst 9800-CL Wireless Controllers for Cloud
Catalyst 9800 Embedded Wireless Controller (Catalyst 9300, 9400 és 9500 sorozatú switcheken)
Catalyst 9800 Series Wireless Controllers
Embedded Wireless Controller a Catalyst AP-kben