Cisco Aironet Access Point Software IOS XE Controller vulnerabilities

4 CVEs affecting Cisco Aironet Access Point Software IOS XE Controller, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-20365, published 2025-09-24.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2024-20418, published 2024-11-06. Critical severity, CVSS 10.0. EPSS: 3.1% chance of exploitation in the next 30 days. A vulnerability in the web-based management interface of Cisco Unified Industrial Wireless Software for Cisco Ultra-Reliable Wireless Backhaul (URWB) Access Points could allow an unauthenticated,…
CVE-2024-20265, published 2024-03-27. Medium severity, CVSS 5.9. EPSS: 0.2% chance of exploitation in the next 30 days. A vulnerability in the boot process of Cisco Access Point (AP) Software could allow an unauthenticated, physical attacker to bypass the Cisco Secure Boot functionality and load a software image that…
CVE-2025-20365, published 2025-09-24. Medium severity, CVSS 4.3. EPSS: 0.2% chance of exploitation in the next 30 days. A vulnerability in the IPv6 Router Advertisement (RA) packet processing of Cisco Access Point Software could allow an unauthenticated, adjacent attacker to modify the IPv6 gateway on an affected…
CVE-2025-20364, published 2025-09-24. Medium severity, CVSS 4.3. EPSS: 0.1% chance of exploitation in the next 30 days. A vulnerability in the Device Analytics action frame processing of Cisco Wireless Access Point (AP) Software could allow an unauthenticated, adjacent attacker to inject wireless 802.11 action frames…