CVE-2025-20293

A vulnerability in the Day One setup process of Cisco IOS XE Software for Catalyst 9800 Series Wireless Controllers for Cloud (9800-CL) could allow an unauthenticated, remote attacker to access the public-key infrastructure (PKI) server that is running on an affected device. This vulnerability is due to incomplete cleanup upon completion of the Day One setup process. An attacker could exploit this vulnerability by sending Simple Certificate Enrollment Protocol (SCEP) requests to an affected device. A successful exploit could allow the attacker to request a certificate from the virtual wireless controller and then use the acquired certificate to join an attacker-controlled device to the virtual wireless controller.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-9800cl-openscep-SB4xtxzP

Configurations

No configuration.

History

26 Sep 2026, 00:10

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad en el proceso de configuración inicial (“Day One setup”) de Cisco IOS XE Software para los controladores inalámbricos Catalyst de la serie 9800 para la nube (9800-CL) podría permitir a un atacante remoto no autenticado acceder al servidor de infraestructura de clave pública (PKI) que se ejecuta en un dispositivo afectado. Esta vulnerabilidad se debe a una limpieza incompleta al finalizar el proceso de configuración inicial. Un atacante podría explotar esta vulnerabilidad enviando solicitudes del protocolo de inscripción de certificados simple (SCEP) a un dispositivo afectado. Un exploit exitoso podría permitir al atacante solicitar un certificado del controlador inalámbrico virtual y luego usar el certificado adquirido para unir un dispositivo controlado por el atacante al controlador inalámbrico virtual.

Information

Published : 2025-09-24 18:15

Updated : 2026-09-26 00:10

NVD link : CVE-2025-20293

Mitre link : CVE-2025-20293

CVE.ORG link : CVE-2025-20293

JSON object : View

Products Affected

No product.

CWE

CWE-459

Incomplete Cleanup

{"id": "CVE-2025-20293", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-20293", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-09-24T17:31:16.493161Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@cisco.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "affected": [{"source": "psirt@cisco.com", "affectedData": [{"vendor": "Cisco", "product": "Cisco IOS XE Software", "versions": [{"status": "affected", "version": "16.10.1"}, {"status": "affected", "version": "16.10.1s"}, {"status": "affected", "version": "16.10.1e"}, {"status": "affected", "version": "16.11.1"}, {"status": "affected", "version": "16.11.1a"}, {"status": "affected", "version": "16.11.1b"}, {"status": "affected", "version": "16.12.1"}, {"status": "affected", "version": "16.12.1s"}, {"status": "affected", "version": "16.12.3"}, {"status": "affected", "version": "16.12.8"}, {"status": "affected", "version": "16.12.2s"}, {"status": "affected", "version": "16.12.1t"}, {"status": "affected", "version": "16.12.4"}, {"status": "affected", "version": "16.12.3s"}, {"status": "affected", "version": "16.12.4a"}, {"status": "affected", "version": "16.12.5"}, {"status": "affected", "version": "16.12.6"}, {"status": "affected", "version": "16.12.6a"}, {"status": "affected", "version": "16.12.7"}, {"status": "affected", "version": "17.1.1"}, {"status": "affected", "version": "17.1.1s"}, {"status": "affected", "version": "17.1.1t"}, {"status": "affected", "version": "17.1.3"}, {"status": "affected", "version": "17.2.1"}, {"status": "affected", "version": "17.2.1a"}, {"status": "affected", "version": "17.3.1"}, {"status": "affected", "version": "17.3.2"}, {"status": "affected", "version": "17.3.3"}, {"status": "affected", "version": "17.3.2a"}, {"status": "affected", "version": "17.3.4"}, {"status": "affected", "version": "17.3.5"}, {"status": "affected", "version": "17.3.6"}, {"status": "affected", "version": "17.3.4c"}, {"status": "affected", "version": "17.3.5a"}, {"status": "affected", "version": "17.3.5b"}, {"status": "affected", "version": "17.3.7"}, {"status": "affected", "version": "17.3.8"}, {"status": "affected", "version": "17.3.8a"}, {"status": "affected", "version": "17.4.1"}, {"status": "affected", "version": "17.5.1"}, {"status": "affected", "version": "17.6.1"}, {"status": "affected", "version": "17.6.2"}, {"status": "affected", "version": "17.6.3"}, {"status": "affected", "version": "17.6.4"}, {"status": "affected", "version": "17.6.5"}, {"status": "affected", "version": "17.6.6"}, {"status": "affected", "version": "17.6.6a"}, {"status": "affected", "version": "17.6.5a"}, {"status": "affected", "version": "17.6.7"}, {"status": "affected", "version": "17.6.8"}, {"status": "affected", "version": "17.7.1"}, {"status": "affected", "version": "17.10.1"}, {"status": "affected", "version": "17.8.1"}, {"status": "affected", "version": "17.9.1"}, {"status": "affected", "version": "17.9.2"}, {"status": "affected", "version": "17.9.3"}, {"status": "affected", "version": "17.9.4"}, {"status": "affected", "version": "17.9.4a"}, {"status": "affected", "version": "17.11.1"}, {"status": "affected", "version": "17.12.1"}, {"status": "affected", "version": "17.12.2"}, {"status": "affected", "version": "17.13.1"}]}]}], "published": "2025-09-24T18:15:34.550", "references": [{"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-9800cl-openscep-SB4xtxzP", "source": "psirt@cisco.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "psirt@cisco.com", "description": [{"lang": "en", "value": "CWE-459"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability in the Day One setup process of Cisco IOS XE Software for Catalyst 9800 Series Wireless Controllers for Cloud (9800-CL) could allow an unauthenticated, remote attacker to access the public-key infrastructure (PKI) server that is running on an affected device.\r\n\r This vulnerability is due to incomplete cleanup upon completion of the Day One setup process. An attacker could exploit this vulnerability by sending Simple Certificate Enrollment Protocol (SCEP) requests to an affected device. A successful exploit could allow the attacker to request a certificate from the virtual wireless controller and then use the acquired certificate to join an attacker-controlled device to the virtual wireless controller."}, {"lang": "es", "value": "Una vulnerabilidad en el proceso de configuraci\u00f3n inicial (\u201cDay One setup\u201d) de Cisco IOS XE Software para los controladores inal\u00e1mbricos Catalyst de la serie 9800 para la nube (9800-CL) podr\u00eda permitir a un atacante remoto no autenticado acceder al servidor de infraestructura de clave p\u00fablica (PKI) que se ejecuta en un dispositivo afectado. Esta vulnerabilidad se debe a una limpieza incompleta al finalizar el proceso de configuraci\u00f3n inicial. Un atacante podr\u00eda explotar esta vulnerabilidad enviando solicitudes del protocolo de inscripci\u00f3n de certificados simple (SCEP) a un dispositivo afectado. Un exploit exitoso podr\u00eda permitir al atacante solicitar un certificado del controlador inal\u00e1mbrico virtual y luego usar el certificado adquirido para unir un dispositivo controlado por el atacante al controlador inal\u00e1mbrico virtual."}], "lastModified": "2026-09-26T00:10:00.127", "sourceIdentifier": "psirt@cisco.com"}