Cisco fixes max severity IOS XE flaw letting attackers hijack devices

Cisco published a critical advisory for a hard-coded JWT vulnerability (CVE-2025-20188, CVSS 10.0) in IOS XE Wireless LAN Controllers that allows unauthenticated remote attackers to upload files, perform path traversal, and execute arbitrary commands as root via the Out-of-Band AP Image Download feature; affected devices include Catalyst 9800 series and embedded wireless controllers. The feature is disabled by default but may be enabled in some deployments; Cisco has released patches and advises applying updates or disabling the feature because no workaround exists, and there are no confirmed active exploitations at this time.