CVE-2025-20364: Cisco Wireless AP Frame Injection Vulnerability

CVE-2025-20364 Overview

Cisco disclosed CVE-2025-20364, a vulnerability in the Device Analytics action frame processing component of Cisco Wireless Access Point (AP) Software. The flaw allows an unauthenticated, adjacent attacker to inject 802.11 action frames containing arbitrary information. Successful exploitation modifies the Device Analytics data associated with valid wireless clients connected to the same wireless controller. The issue is tracked under [CWE-346: Origin Validation Error] and stems from insufficient verification of incoming 802.11 action frames.

Critical Impact
An adjacent attacker within wireless range can forge Device Analytics action frames and corrupt analytics data for legitimate clients associated with the affected wireless controller.

Affected Products

Cisco Wireless Access Point (AP) Software
Access points managed by a Cisco wireless controller processing Device Analytics action frames
Refer to the Cisco Security Advisory for the authoritative list of affected releases

Discovery Timeline

2025-09-24 - CVE-2025-20364 published to the National Vulnerability Database
2026-09-26 - Last updated in NVD database

Technical Details for CVE-2025-20364

Vulnerability Analysis

The vulnerability resides in how Cisco Wireless AP Software validates 802.11 Device Analytics action frames. Device Analytics is a Cisco feature that exchanges client telemetry between wireless endpoints and the wireless infrastructure over management action frames. The AP software does not sufficiently verify the origin or contents of these frames before accepting the enclosed analytics parameters.

Because the frames are consumed without adequate authentication of the sender, an attacker within radio range can transmit crafted action frames that impersonate a legitimate client. The controller then updates its Device Analytics records for that client using attacker-supplied values. The impact is limited to integrity of analytics telemetry; the advisory does not describe confidentiality loss or service disruption.

Root Cause

The root cause is an origin validation error in the action frame processing path. The receiver trusts the source and payload fields of inbound 802.11 Device Analytics action frames without cryptographic binding or additional identity checks. This mismatch between assumed and actual frame provenance enables spoofed telemetry.

Attack Vector

Exploitation requires wireless proximity to an affected access point, meaning the attacker must be on an adjacent network within radio range. No authentication or user interaction is required. The attacker transmits 802.11 Device Analytics action frames populated with arbitrary parameters, and the controller applies the injected values to records for wireless clients associated with the same controller. Technical exploitation details are described in the Cisco Security Advisory.

No public proof-of-concept, exploit code, or reports of in-the-wild exploitation are available at the time of publication.

Detection Methods for CVE-2025-20364

Indicators of Compromise

Unexpected changes to Device Analytics attributes for wireless clients that do not correlate with client-reported state changes
802.11 action frames sourced from MAC addresses that do not match the associated station's normal traffic pattern
Bursts of Device Analytics action frames arriving outside of normal client association or roaming events

Detection Strategies

Enable and forward wireless intrusion detection (wIDS) logs from Cisco controllers to a centralized analytics platform for correlation
Baseline Device Analytics telemetry per client and alert on abrupt attribute changes without a corresponding reassociation event
Correlate radio-layer frame captures with controller-side analytics updates to identify spoofed frames

Monitoring Recommendations

Ingest wireless controller syslog and management-frame telemetry into a SIEM or data lake for long-term retention
Monitor for repeated action frame anomalies concentrated around specific access points, which may indicate a local attacker
Review Device Analytics-driven policy decisions (posture, QoS, segmentation) for unexplained changes

How to Mitigate CVE-2025-20364

Immediate Actions Required

Review the Cisco Security Advisory and identify affected AP software releases in the environment
Apply the fixed Cisco Wireless AP Software release identified in the advisory once available for your platform
Audit any automated policy or access decisions that consume Device Analytics attributes and validate them against independent telemetry

Patch Information

Cisco provides fixed software releases and remediation guidance in the Cisco Security Advisory cisco-sa-action-frame-inj-QqCNcz8H. Administrators should confirm the target release supports their controller and AP hardware before deployment.

Workarounds

The Cisco advisory is the authoritative source for supported workarounds; consult it before implementing configuration changes
Where Device Analytics is not required, evaluate disabling the feature on the wireless controller to remove the exposed processing path
Restrict physical and RF access to areas around access points to reduce adjacent-network exposure

bash

# Consult the Cisco Security Advisory for exact CLI commands and supported
# fixed releases before making changes on production wireless controllers.
# Example workflow (verify commands against your platform documentation):
#   1. show version                       # identify running AP software release
#   2. show wireless client summary       # enumerate associated clients
#   3. Apply the fixed image per Cisco advisory cisco-sa-action-frame-inj-QqCNcz8H