Skip to main content
Live Webinar with SANS (June 25)— Agentic CTI Automation for Fun & ProfitRegister Free
Mallory
Back to vulnerabilities
Medium

Access Control Bypass in Cisco IOS XE 9800-CL PKI/SCEP Day One Setup

IdentifiersCVE-2025-20293CWE-284

CVE-2025-20293 is an access control bypass vulnerability in the Day One setup process of Cisco IOS XE Software for Catalyst 9800 Series Wireless Controllers for Cloud (9800-CL). The flaw is caused by incomplete cleanup after the Day One setup process finishes, leaving the PKI server on the affected virtual wireless controller accessible when it should no longer be exposed for that purpose. An unauthenticated remote attacker can exploit the issue by sending Simple Certificate Enrollment Protocol (SCEP) requests to the affected device. If successful, the attacker can obtain a certificate from the controller’s PKI service and use that certificate to enroll or join an attacker-controlled device to the virtual wireless controller.

Share:
For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial
ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation allows an unauthenticated remote attacker to bypass intended access restrictions on the controller’s certificate services. By obtaining a valid certificate from the affected PKI server, the attacker can impersonate a trusted device for onboarding purposes and join an attacker-controlled device to the virtual wireless controller. This can undermine trust in the controller’s certificate-based enrollment process and may enable unauthorized device association and follow-on access within the wireless infrastructure managed by the controller.

Mitigation

If you can’t patch tonight, do this now.

If immediate patching is not possible, reduce exposure of the affected PKI/SCEP service by restricting network access to the controller so that only trusted administrative or provisioning hosts can reach it, especially over interfaces exposed beyond the intended deployment boundary. Review whether Day One setup has completed and whether certificate enrollment services remain unnecessarily reachable. Monitor for unexpected SCEP enrollment activity and unauthorized certificate issuance or device joins. The supplied content does not provide Cisco-specific workaround details, so vendor guidance should be consulted for any supported temporary mitigations.

Remediation

Patch, then assume compromise.

Cisco indicates that affected products should be updated in accordance with the vendor’s advisory and version-specific guidance. Remediation consists of installing a fixed Cisco IOS XE Software release for Catalyst 9800-CL that properly cleans up or disables the Day One setup PKI/SCEP exposure after initial setup is complete. Specific fixed versions are not provided in the supplied content and should be confirmed in Cisco’s official advisory for CVE-2025-20293.
PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

ACTIVITY FEED

Recent activity

5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

5 SOURCESView more in app
What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.
Start free trial
Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity3

Community discussion across Reddit, Mastodon, and other social sources.

EXTERNAL REFERENCES
MITRE CVE
cve.org · CVE-2025-20293
NVD
nvd.nist.gov/vuln/detail/CVE-2025-20293
MITRE CWE · CWE-284
cwe.mitre.org
sec.cloudapps.cisco.com
sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-9800cl-openscep-SB4xtxzP