CVE-2025-20293 Overview
CVE-2025-20293 affects the Day One setup process of Cisco IOS XE Software for Catalyst 9800 Series Wireless Controllers for Cloud (9800-CL). The flaw stems from incomplete cleanup after Day One setup completes, leaving a public-key infrastructure (PKI) server reachable on the device. An unauthenticated, remote attacker can send Simple Certificate Enrollment Protocol (SCEP) requests to the virtual wireless controller and obtain a valid certificate. The attacker can then use that certificate to join an attacker-controlled device to the virtual wireless controller. The vulnerability is categorized under [CWE-459] Incomplete Cleanup.
Critical Impact
An unauthenticated remote attacker can obtain a certificate from the affected 9800-CL PKI server and join a rogue device to the virtual wireless controller.
Affected Products
- Cisco IOS XE Software
- Cisco Catalyst 9800 Series Wireless Controllers for Cloud (9800-CL)
- Virtual wireless controllers configured via Day One setup
Discovery Timeline
- 2025-09-24 - CVE-2025-20293 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-20293
Vulnerability Analysis
The vulnerability lives in the Day One setup workflow for the Catalyst 9800-CL virtual wireless controller. During Day One provisioning, the controller runs a PKI server that issues certificates using the Simple Certificate Enrollment Protocol (SCEP). When the setup process finishes, the platform fails to fully tear down the SCEP-facing PKI server. An unauthenticated, remote attacker who can reach the controller over the network can enroll and receive a legitimate certificate. That certificate is trusted by the virtual wireless controller and permits an attacker-controlled device to associate as a peer.
Root Cause
The root cause is incomplete cleanup of Day One provisioning state [CWE-459]. The SCEP endpoint and the PKI enrollment authority remain active after the setup workflow completes, when they should be disabled or restricted. Because SCEP enrollment does not require prior authentication in this configuration, any network-reachable client can request a certificate.
Attack Vector
The attack requires only network access to the affected controller. An attacker crafts SCEP enrollment requests targeting the residual PKI server on the 9800-CL. After receiving a signed certificate, the attacker presents it from an attacker-controlled device to authenticate against the virtual wireless controller. No user interaction, credentials, or prior foothold are needed.
No verified public exploit code is available. Refer to the Cisco Security Advisory for the vendor's technical description.
Detection Methods for CVE-2025-20293
Indicators of Compromise
- Unexpected SCEP enrollment requests (GetCACert, PKIOperation) reaching the 9800-CL management interface from untrusted sources.
- Issued certificates in the controller's PKI server logs that do not correspond to known administrator-initiated enrollments.
- New or unknown devices joining the virtual wireless controller shortly after SCEP activity.
Detection Strategies
- Inspect Cisco IOS XE logs on 9800-CL instances for crypto pki server activity and certificate issuance events following Day One completion.
- Query the controller for active PKI server state using show crypto pki server and confirm whether SCEP endpoints remain enabled.
- Alert on inbound HTTP requests to SCEP URIs (typically /cgi-bin/pkiclient.exe or /scep) targeting controller IP addresses.
Monitoring Recommendations
- Forward controller syslog and PKI events to a centralized SIEM and baseline expected certificate enrollment volume.
- Monitor authentication and association events on the wireless controller for unrecognized device certificates or serial numbers.
- Track network flows to management interfaces of 9800-CL instances and alert on SCEP traffic from outside the administrative network.
How to Mitigate CVE-2025-20293
Immediate Actions Required
- Apply the fixed Cisco IOS XE Software release identified in the Cisco Security Advisory for 9800-CL.
- Restrict network access to the 9800-CL management and SCEP endpoints to trusted administrative networks only.
- Audit the controller PKI server and revoke any certificates that were not issued through authorized administrative processes.
Patch Information
Cisco has published a security advisory and fixed software releases for Catalyst 9800-CL. Administrators should consult the Cisco Security Advisory (cisco-sa-9800cl-openscep-SB4xtxzP) for fixed release identifiers and upgrade guidance specific to their deployment.
Workarounds
- Disable the residual PKI server on the controller after Day One setup completes by removing crypto pki server configuration that is not required.
- Enforce access control lists on management interfaces to block untrusted sources from reaching SCEP endpoints.
- Terminate SCEP-related listeners by disabling the embedded HTTP/HTTPS server on interfaces exposed to untrusted networks where feasible.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
