Cisco IOS XE Wireless Controller Software Cisco Discovery Protocol Denial of

🚨SEVERITY: HIGH — CVSS 7.4Security Advisory

TL;DR 📌

  • A vulnerability in Cisco IOS XE Wireless Controller Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to insufficient input validation of access point (AP) Cisco Discovery Protocol (CDP) neighbor reports when they are processed by the wireless controller. An attacker…
  • Highest CVSS: 7.4 (High).
  • Check the advisory for fixed releases — remediation detail is in the vendor link below.
  • CVEs: CVE-2025-20202.

What it is

CVE-2025-20202 is a denial-of-service vulnerability in Cisco IOS XE Wireless Controller Software, specifically in how the wireless controller processes Cisco Discovery Protocol (CDP) neighbor reports sent from access points (APs). The controller does not sufficiently validate these AP CDP reports.

The attack path is adjacent rather than remote-over-the-internet: an attacker needs to be able to send a crafted CDP packet to an AP that is joined to the affected controller. No authentication is required. CDP is enabled by default on AP join profiles, so unless it has been explicitly turned off, a device managing APs is exposed.

A successful attack causes the wireless controller managing the AP to reload unexpectedly, producing a DoS condition that takes down the wireless network served by that controller — not just a single AP.

Affected products are Catalyst 9800-CL Wireless Controllers for Cloud, Catalyst 9800 Embedded Wireless Controllers for Catalyst 9300, 9400, and 9500 Series switches, Catalyst 9800 Series Wireless Controllers, and Embedded Wireless Controllers on Catalyst APs, when running a vulnerable IOS XE release with AP CDP enabled. Cisco IOS Software, IOS XR Software, Meraki products, NX-OS Software, and WLC AireOS Software are confirmed not affected. CVSS score is 7.4 (High), vector AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H — adjacent access, low complexity, no privileges or user interaction, scope change, availability impact only.

What to do

  • Check whether AP CDP is enabled: on the controller CLI, run show running-config | section ap profile and look for no cdp under each AP Join profile. If any profile lacks that line, CDP is enabled and the device is exposed.
  • Apply Cisco’s fixed software for your platform. The advisory does not give version numbers in the summary text; use the Cisco Software Checker against this advisory to identify the first fixed release for your current IOS XE version, and check the advisory’s Fixed Software section for the confirmed list.
  • If you cannot patch immediately, disable AP CDP on every AP Join profile as an interim measure — there is no other workaround. This can be done via the GUI (Configuration > Tags & Profiles > AP Join > Management > CDP Interface > Disabled) or CLI (ap profile <name>, then no cdp for each profile). Confirm the setting negatively affects any CDP-dependent tooling before rolling it out broadly.
  • Re-run the show running-config | section ap profile check after remediation to confirm every profile shows no cdp.
  • This is one advisory within Cisco’s May 2025 semiannual IOS and IOS XE bundled publication; if you run other Cisco IOS XE devices, check the linked event response for related advisories that may need separate action.

For leadership 🧭

Executive summary. A single crafted network packet aimed at an access point can force its wireless controller to reload, taking the whole managed wireless network offline until it recovers. Because CDP is enabled by default and no authentication is needed, this should be checked and remediated within the current change cycle rather than left for routine patching.

Why it matters:

  • The flaw sits in how Catalyst 9800 controllers (including 9800-CL, embedded variants on 9300/9400/9500 switches, and embedded controllers on Catalyst APs) parse CDP neighbor reports from joined APs.
  • No credentials or user interaction are needed — an attacker adjacent to an AP can trigger an unexpected controller reload, which knocks out every AP that controller manages, not just the one targeted.
  • CDP is enabled by default in AP Join profiles, so any deployment that hasn’t explicitly disabled it is exposed until patched.
  • There is no workaround beyond disabling AP CDP entirely, which may affect network visibility tooling that relies on it.

Now / Next / Later:

  • Now: Run show running-config | section ap profile on each wireless controller and confirm every AP Join profile contains no cdp; where it’s missing, the controller is exposed today.
  • Next: During the next change window, apply Cisco’s fixed IOS XE release for the affected platform (use the Cisco Software Checker against this advisory) or, if patching must wait, disable CDP on every AP Join profile via CLI or GUI as an interim measure.
  • Later: Make disabling unneeded discovery protocols (CDP/LLDP) on AP join profiles a standard baseline in wireless controller build templates, and review the other advisories in Cisco’s May 2025 IOS XE bundle for related exposure across the estate.

Source