Cisco IOS XE Wireless Controller Arbitrary File Upload (cisco-sa-wlc-file-uplpd-rHZG9UfC)

#TRUSTED 55ff6e8a19fc3a8ac7adaf9d125f734041d1acb80c66bf9f319d92e5bb70d3a28b4f66b6694793b584ed359bc28c6e61ba9d80ac7c7e98cf5865a494d9cd952bdfc2af48d78950970823a943152a7e50a1dd8f7ccfee94387f5a01cf2ad06c206f55f36222a4cb840abae96cf72cc47ec830a241d87f6458d6d20ab627319b4d7ebac285a02a0112367ca9adab576e481f8583c1d2e5f115e8c7eedc6f8adff721ff4ee88da7ec981cc70987f0be69ac1ebaa552e23dc44786d86909946b3f1372c469930e0308132266da022e6f3e58a9b7cbcae9022dd08be9d527df163773169011af1fa3172b72d277c313da1ecd73b107ff7383f867ec0dab448bb7b143219d6d1f5982d314f59a24bd5b4ceef8ce6e64e11ad1ac736d7c555ab883c53645eaf15d6d26e097a1b92b0407c246d5b8207c0992b32e9faf42b56ff7082b0f77e27054ae7c10ccaa32b4641f1cabacbebc8d285f00b1b95e41f717f7aca6645d2a137e11b973af0681b98abc34030d1faf36ffd6d90eb34c4705e0265b4c8a0fc44bd261139c208d0417845465a6fda8f6c5436c0d9f263ad8408bd17d23a66500b1ec116afe6a1896d10aa485a1912a15cc7e432f1e8c4d83c9a397cc844f3a04311544d8caacadf95404c71fd6eb2096493cf0a3b2d042f1919d660f3722bd7c990e6f340361d607b7ad5e1200164f2b6f5db01aaf013e301923a1b0b0fc
#TRUST-RSA-SHA256 4e4324e775e5ee84de04603ebaa1aa2d39d19ada5e4dfb7569246f5128c51e853932b8cabd1c0be7451b3e26e97340ed5b1f7d9c40e97ab68608d882dd7276298641fc070cf6bfca6bce560ae5025f2d0c422322d8440b3878b15105533ac9ad50f4b36da436239a349475da892c50332be7156b73f87ea9437e4b55cdfb645a61401350bee28e587d0bfc2cd0b92e85b0b28adce366f647ca1595aa7809a61175fb334681ecbf71766c985eb17f168983603c53a75390f3686a085d2b9d6df59116542b75cc23a16013aa91cc4ed5ebda74717241abb385a389b1e8d5960a4e7476345e7896b7bc29033e1f9a6f6d1e600ede2efcc4483438d836ef4cea8743e5964f5eadb9fc133d143eee3ecb3e411fbfd5d8d5682d1844980823f082d672ef212f186eb731b64d279cd8336d05ad123abb46119138167dc5816314dd77ef890b05552adeb29c5f7a728d1558ece0e98e91a3d55812190790e1485c9abcad89c5a8b1395afb16c6921647c5833d78eb0fe2ac5a43d8d7d1cac830398e11d9719d029d21c7695bc9156252d0b4902b1d612d28281587db61a5e825c885ae431c42c0f0fab43411774ccd8073f6aec10a11101d97bef4c7057b299dac7add11c5dafde664872ad998b977f50e35de329fd56b4f518816eeaf1cbb8db323d1264ac3c9ca4785c02d3ae911d0c9bd6c58cc8221a4ef4d115c713742e68a75a956
#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(236785);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/05/15");

  script_cve_id("CVE-2025-20188");
  script_xref(name:"CISCO-BUG-ID", value:"CSCwk33139");
  script_xref(name:"CISCO-SA", value:"cisco-sa-wlc-file-uplpd-rHZG9UfC");
  script_xref(name:"IAVA", value:"2025-A-0318");

  script_name(english:"Cisco IOS XE Wireless Controller Arbitrary File Upload (cisco-sa-wlc-file-uplpd-rHZG9UfC)");

  script_set_attribute(attribute:"synopsis", value:
"The remote device is missing a vendor-supplied security patch");
  script_set_attribute(attribute:"description", value:
"According to its self-reported version, Cisco IOS-XE Software is affected by a vulnerability.

  - A vulnerability in the Out-of-Band Access Point (AP) Image Download feature of Cisco IOS XE Software for
    Wireless LAN Controllers (WLCs) could allow an unauthenticated, remote attacker to upload arbitrary files
    to an affected system. This vulnerability is due to the presence of a hard-coded JSON Web Token (JWT) on
    an affected system. An attacker could exploit this vulnerability by sending crafted HTTPS requests to the
    AP image download interface. A successful exploit could allow the attacker to upload files, perform path
    traversal, and execute arbitrary commands with root privileges. Note: For exploitation to be successful,
    the Out-of-Band AP Image Download feature must be enabled on the device. It is not enabled by default.
    (CVE-2025-20188)

Please see the included Cisco BIDs and Cisco Security Advisory for more information.");
  # https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-wlc-file-uplpd-rHZG9UfC
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?e0d2e64f");
  # https://sec.cloudapps.cisco.com/security/center/viewErp.x?alertId=ERP-75279
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?564dd2a1");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwk33139");
  script_set_attribute(attribute:"solution", value:
"Upgrade to the relevant fixed version referenced in Cisco bug ID CSCwk33139");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-20188");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(798);

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/05/07");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/05/07");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/05/15");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:ios_xe");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CISCO");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("cisco_ios_xe_version.nasl");
  script_require_keys("Host/Cisco/IOS-XE/Version", "Host/Cisco/IOS-XE/Model");

  exit(0);
}

include('cisco_workarounds.inc');
include('ccf.inc');

var product_info = cisco::get_product_info(name:'Cisco IOS XE Software');

var model = toupper(product_info.model);

# Vulnerable model list
if (model !~ "C(930|940|950|980)[0-9]")
    audit(AUDIT_HOST_NOT, 'affected');

var version_list = make_list(
  '17.7.1',
  '17.8.1',
  '17.9.1',
  '17.9.2',
  '17.9.3',
  '17.9.4',
  '17.9.4a',
  '17.9.5',
  '17.10.1',
  '17.10.1b',
  '17.11.1',
  '17.11.99SW',
  '17.12.1',
  '17.12.2',
  '17.12.3',
  '17.13.1',
  '17.14.1'
);

var workarounds = make_list(CISCO_WORKAROUNDS['generic_workaround']);
var workaround_params = WORKAROUND_CONFIG['ap_upgrade'];

var reporting = make_array(
  'port'    , product_info['port'],
  'severity', SECURITY_HOLE,
  'version' , product_info['version'],
  'cmds'    , make_list('show running-config'),
  'bug_id'  , 'CSCwk33139'
);

cisco::check_and_report(
  product_info:product_info,
  workarounds:workarounds,
  workaround_params : workaround_params,
  reporting:reporting,
  vuln_versions:version_list
);