Cisco Patches CVE-2025-20188 (10.0 CVSS) in IOS XE That Enables Root Exploits via JWT

Cisco has released software fixes to address a maximum-severity security flaw in its IOS XE Wireless Controller that could enable an unauthenticated, remote attacker to upload arbitrary files to a susceptible system. The vulnerability, tracked as CVE-2025-20188 , has been rated 10.0 on the CVSS...

H3C GR-5400AX security vulnerabilities

The H3C GR-5400AX is an enterprise Wi-Fi 6 wireless controller from China's Xinhua San H3C. A security vulnerability exists in the H3C GR-5400AX 100R008 and prior versions, which stems from a buffer overflow due to incorrect manipulation of the parameter param in file/goform/aspForm...

PT-2025-20342

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A vulnerability in the Linux kernel has been resolved, specifically in the xhci Extensible Host Controller Interface component related to the Etron workaround. The issue involves an...

CVE-2025-20202

A vulnerability in Cisco IOS XE Wireless Controller Software could allow an unauthenticated, adjacent attacker to cause a denial of service DoS condition on an affected device. This vulnerability is due to insufficient input validation of access point AP Cisco Discovery Protocol CDP neighbor...

CVE-2025-20202

A vulnerability in Cisco IOS XE Wireless Controller Software could allow an unauthenticated, adjacent attacker to cause a denial of service DoS condition on an affected device. This vulnerability is due to insufficient input validation of access point AP Cisco Discovery Protocol CDP neighbor...

CVE-2025-20190

A vulnerability in the lobby ambassador web interface of Cisco IOS XE Wireless Controller Software could allow an authenticated, remote attacker to remove arbitrary users that are defined on an affected device. This vulnerability is due to insufficient access control of actions executed by lobby...

CVE-2025-20186

A vulnerability in the web-based management interface of the Wireless LAN Controller feature of Cisco IOS XE Software could allow an authenticated, remote attacker with a lobby ambassador user account to perform a command injection attack against an affected device. This vulnerability is due to...

CVE-2025-20186

CVE-2025-20186 affects Cisco IOS XE Software, specifically the web-based management interface of the Wireless LAN Controller. The vulnerability arises from insufficient input validation in the WLC web UI, allowing an authenticated attacker with a lobby ambassador account to inject arbitrary CLI c...

CVE-2025-20140

A vulnerability in the Wireless Network Control daemon wncd of Cisco IOS XE Software for Wireless LAN Controllers WLCs could allow an unauthenticated, adjacent wireless attacker to cause a denial of service DoS condition. This vulnerability is due to improper memory management. An attacker could...

CVE-2025-20202

CVE-2025-20202 affects Cisco IOS XE Wireless Controller Software. The root cause is insufficient input validation of AP Cisco Discovery Protocol (CDP) neighbor reports processed by the wireless controller. An unauthenticated, adjacent attacker can send a crafted CDP packet to an AP, which could c...

CVE-2025-20202

A vulnerability in Cisco IOS XE Wireless Controller Software could allow an unauthenticated, adjacent attacker to cause a denial of service DoS condition on an affected device. This vulnerability is due to insufficient input validation of access point AP Cisco Discovery Protocol CDP neighbor...

CVE-2025-20202

A vulnerability in Cisco IOS XE Wireless Controller Software could allow an unauthenticated, adjacent attacker to cause a denial of service DoS condition on an affected device. This vulnerability is due to insufficient input validation of access point AP Cisco Discovery Protocol CDP neighbor...

CVE-2025-20190

A vulnerability in the lobby ambassador web interface of Cisco IOS XE Wireless Controller Software could allow an authenticated, remote attacker to remove arbitrary users that are defined on an affected device. This vulnerability is due to insufficient access control of actions executed by lobby...

Cisco IOS XE Wireless Controller Software Cisco Discovery Protocol Denial of Service Vulnerability

A vulnerability in Cisco IOS XE Wireless Controller Software could allow an unauthenticated, adjacent attacker to cause a denial of service DoS condition on an affected device. This vulnerability is due to insufficient input validation of access point AP Cisco Discovery Protocol CDP neighbor...

Cisco IOS XE Wireless Controller Software Unauthorized User Deletion Vulnerability

A vulnerability in the lobby ambassador web interface of Cisco IOS XE Wireless Controller Software could allow an authenticated, remote attacker to remove arbitrary users that are defined on an affected device. This vulnerability is due to insufficient access control of actions executed by lobby...

CVE-2025-4259

A vulnerability has been found in newbee-mall 1.0 and classified as critical. Affected by this vulnerability is the function Upload of the file ltd/newbee/mall/controller/common/UploadController.java. The manipulation of the argument File leads to unrestricted upload. The attack can be launched...

CVE-2025-20191: Buffer Access with Incorrect Length Value

A vulnerability in the Switch Integrated Security Features SISF of Cisco IOS Software, Cisco IOS XE Software, Cisco NX-OS Software, and Cisco Wireless LAN Controller WLC AireOS Software could allow an unauthenticated, adjacent attacker to cause a denial of service DoS condition on an affected...

CVE-2025-20190: Improper Access Control

A vulnerability in the lobby ambassador web interface of Cisco IOS XE Wireless Controller Software could allow an authenticated, remote attacker to remove arbitrary users that are defined on an affected device. This vulnerability is due to insufficient access control of actions executed by lobby...

PT-2025-20274 · Cisco · Cisco Ios Xe Wireless Controller +1

Name of the Vulnerable Software and Affected Versions: Cisco IOS XE Wireless Controller Software affected versions not specified Description: A vulnerability could allow an unauthenticated, adjacent attacker to cause a denial of service DoS condition on an affected device. This issue is due to...

Delta Electronics ISPSoft Stack Buffer Overflow Vulnerability (CNVD-2025-12375)

Delta Electronics ISPSoft is a programmable logic controller PLC programming software from Delta Electronics. A stack buffer overflow vulnerability exists in Delta Electronics ISPSoft, which can be exploited by an attacker to execute arbitrary code using debugging logic when parsing CBDGL files...