A critical remote code execution vulnerability in Cisco IOS XEhas been disclosed and analyzed in depth, revealing significant exploitation risks. The flaw, tracked as CVE-2025-20188 with a CVSS score of 10, affects various Cisco Catalyst 9800 wireless controller models and stems from a hardcoded JSON Web Token (JWT) fallback secret (“notfound”) used by backend Lua scripts in the Out-of-Band Access Point (AP) image download feature. When this feature is enabled, unauthenticated attackers can craft HTTPS requests to port 8443, leveraging the weak JWT validation and insufficient path sanitization to perform arbitrary file uploads, path traversal, and ultimately execute commands with root privileges. Horizon3.ai’s technical analysis demonstrated that attackers can generate valid JWTs without knowing any real secrets and exploit services like pvp.sh, which monitor specific directories, to trigger configuration file reloads that run attacker-controlled commands. While no ready-made exploit has been released, the detailed information now available makes weaponization highly feasible. Cisco released patches on May 7, 2025, and strongly advises affected users to upgrade to IOS XE version 17.12.04 or later or disable the vulnerable feature if immediate patching is not possible. CTIX analysts recommend that any affected readers should ensure their controllers are patched to prevent future exploitation.