Vulnerability in Cisco IOS XE Software for Catalyst 9800 Series Wireless Controllers

CVE-2025-20293

What is CVE-2025-20293?

A vulnerability in the initial Day One setup process of Cisco IOS XE Software for Catalyst 9800 Series Wireless Controllers could permit an unauthenticated, remote attacker to access the public-key infrastructure server on affected devices. This issue arises due to insufficient cleanup after the Day One setup, allowing attackers to send Simple Certificate Enrollment Protocol requests. An exploit could enable attackers to acquire a certificate from the virtual wireless controller, facilitating the unauthorized joining of malicious devices to the controller.

References