TL;DR 📌

A Medium severity vulnerability has been identified in Cisco IOS XE Software affecting Catalyst 9500X and 9600X Series Switches. An unauthenticated remote attacker could exploit this vulnerability to bypass configured access control lists (ACLs) on affected devices. Cisco has released software updates to address this issue, and there are workarounds available.

What happened 🕵️‍♂️

A vulnerability in the access control list (ACL) programming of Cisco IOS XE Software allows an unauthenticated, remote attacker to bypass a configured ACL on affected devices. This occurs when an attacker floods traffic from an unlearned MAC address on a switch virtual interface (SVI) with an egress ACL applied. If the MAC address table is full or flushed, the attacker could successfully bypass the egress ACL.

TL;DR 📌

A command injection vulnerability has been identified in the HTTP API subsystem of Cisco IOS XE Software. This flaw could allow an attacker to execute commands with root privileges, posing a significant security risk. Users are advised to upgrade to fixed software as there are no workarounds available.

What happened 🕵️‍♂️

Cisco has disclosed a vulnerability in the HTTP API subsystem of Cisco IOS XE Software that could allow a remote attacker to inject commands that execute with root privileges. This vulnerability arises from insufficient input validation. An attacker with administrative privileges could exploit this by authenticating to an affected system and making an API call with crafted input. Alternatively, an unauthenticated attacker could trick a legitimate user with administrative privileges into clicking a malicious link. Successful exploitation could lead to arbitrary command execution as the root user.

TL;DR 📌

• A vulnerability in the Out-of-Band Access Point (AP) Image Download, the Clean Air Spectral Recording, and the client debug bundles features of Cisco IOS XE Software for Wireless LAN Controllers (WLCs) could allow an unauthenticated, remote attacker to upload arbitrary files to an affected system. This vulnerability is due to the presence of a hard-coded JSON Web Token (JWT) on…
• No fixed release listed yet; apply mitigations and monitor.
• Workarounds are documented in the advisory.
• CVEs: CVE-2025-20188.

What happened 🕵️‍♂️

A vulnerability in the Out-of-Band Access Point (AP) Image Download, the Clean Air Spectral Recording, and the client debug bundles features of Cisco IOS XE Software for Wireless LAN Controllers (WLCs) could allow an unauthenticated, remote attacker to upload arbitrary files to an affected system.