Technical details about a maximum-severity Cisco IOS XE WLC arbitrary file upload flaw tracked as CVE-2025-20188 have been made publicly available, bringing us closer to a working exploit.

The write-up by Horizon3 researchers does not contain a ‘ready-to-run’ proof of concept RCE exploit script, but it does provide enough information for a skilled attacker or even an LLM to fill in the missing pieces.

Given the immediate risk of weaponization and widespread use in attacks, it is recommended that impacted users take action now to protect their endpoints.

The Cisco IOS XE WLC flaw

Cisco disclosed the critical flaw in IOS XE Software for Wireless LAN Controllers on May 7, 2025, which allows an attacker to take over devices.

The vendor said it is caused by a hard-coded JSON Web Token (JWT) that allows an unauthenticated, remote attacker to upload files, perform path traversal, and execute arbitrary commands with root privileges.

The bulletin noted that CVE-2025-20188 is only dangerous when the ‘Out-of-Band AP Image Download’ feature is enabled on the device, in which case, the following device models are at risk:

• Catalyst 9800-CL Wireless Controllers for Cloud
• Catalyst 9800 Embedded Wireless Controller for Catalyst 9300, 9400, and 9500 Series Switches
• Catalyst 9800 Series Wireless Controllers
• Embedded Wireless Controller on Catalyst APs

Horizon3’s attack example

Horizon3’s analysis shows that the flaw exists due to a hardcoded JWT fallback secret (“notfound”) used by the backend Lua scripts for upload endpoints combined with insufficient path validation.

Specifically, the backend uses OpenResty (Lua + Nginx) scripts to validate JWT tokens and handle file uploads, but if the ‘/tmp/nginx_jwt_key’ file is missing, the script falls back to the string “notfound” as the secret to verify JWTs.

This basically allows attackers to generate valid tokens without knowing any secrets by simply using ‘HS256’ and ‘notfound.’

Horizon3’s example sends an HTTP POST request with a file upload to the ‘/ap_spec_rec/upload/’ endpoint via port 8443 and uses filename path traversal to drop an innocuous file (foo.txt) outside the intended directory.

To escalate the file upload flaw to remote code execution, the attacker could overwrite configuration files loaded by backend services, drop web shells, or abuse monitored files to trigger unauthorized actions.

Horizon3’s example abuses the ‘pvp.sh’ service that monitors specific directories, overwrites the config files it depends on, and triggers a reload even to run attacker commands.

Given the elevated risk of exploitation, users are recommended to upgrade to a patched version (17.12.04 or newer) as soon as possible.

As a temporary workaround, admins can turn off the Out-of-Band AP Image Download feature to close the vulnerable service.

Google has released emergency security updates to patch a high-severity vulnerability in the Chrome web browser that could lead to full account takeover following successful exploitation.

While it’s unclear if this security flaw has been used in attacks, the company warned that it has a public exploit, which is how it usually hints at active exploitation.

“Google is aware of reports that an exploit for CVE-2025-4664 exists in the wild,” Google said in a Wednesday security advisory.

The vulnerability was discovered by Solidlab security researcher Vsevolod Kokorin and is described as an insufficient policy enforcement in Google Chrome’s Loader component that lets remote attackers leak cross-origin data via maliciously crafted HTML pages.

“You probably know that unlike other browsers, Chrome resolves the Link header on subresource requests. But what’s the problem? The issue is that the Link header can set a referrer-policy. We can specify unsafe-url and capture the full query parameters,” Kokorin explained.

“Query parameters can contain sensitive data – for example, in OAuth flows, this might lead to an Account Takeover. Developers rarely consider the possibility of stealing query parameters via an image from a 3rd-party resource.”

​Google fixed the flaw for users in the Stable Desktop channel, with patched versions (136.0.7103.113 for Windows/Linux and 136.0.7103.114 for macOS) rolling out to users worldwide.

Although the company says the security updates will roll out over the coming days and weeks, they were immediately available when BleepingComputer checked for updates.

Users who don’t want to update Chrome manually can also let the browser automatically check for new updates and install them after the next launch.

In March, ​Google also fixed a high-severity Chrome zero-day bug (CVE-2025-2783) that was abused to deploy malware in espionage attacks targeting Russian government organizations, media outlets, and educational institutions.

Kaspersky researchers who discovered the actively exploited zero-day said that the attackers use CVE-2025-2783 exploits to bypass Chrome sandbox protections and infect targets with malware.

Last year, Google patched 10 zero-days disclosed during the Pwn2Own hacking competition or exploited in attacks.

A maximum severity remote code execution (RCE) vulnerability has been discovered impacting all versions of Apache Parquet up to and including 1.15.0.

The problem stems from the deserialization of untrusted data that could allow attackers with specially crafted Parquet files to gain control of target systems, exfiltrate or modify data, disrupt services, or introduce dangerous payloads such as ransomware.

The vulnerability is tracked under CVE-2025-30065 and has a CVSS v4 score of 10.0. The flaw was fixed with the release of Apache version 1.15.1.

It should be noted that to exploit this flaw, threat actors must convince someone to import a specially crafted Parquet file.

Severe threat to “big data” environments

Apache Parquet is an open-source, columnar storage format designed for efficient data processing. Unlike row-based formats (like CSV), Parquet stores data by columns, which makes it faster and more space-efficient for analytical workloads.

It is widely adopted across the data engineering and analytics ecosystem, including big data platforms like Hadoop, AWS, Amazon, Google, and Azure cloud services, data lakes, and ETL tools.

Some large companies that use Parquet include Netflix, Uber, Airbnb, and LinkedIn.

The security problem in Parquet was disclosed on April 1, 2025, following a responsible disclosure by its finder, Amazon researcher Keyi Li.

“Schema parsing in the parquet-avro module of Apache Parquet 1.15.0 and previous versions allows bad actors to execute arbitrary code,” warned the short bulletin published on Openwall.

“Users are recommended to upgrade to version 1.15.1, which fixes the issue.”

A separate bulletin by Endor Labs highlights the risk of CVE-2025-30065 exploitation more clearly, warning that the flaw can impact any data pipelines and analytics systems that import Parquet files, with the risk being significant for files sourced from external points.

Endor Labs believes the problem was introduced in Parquet version 1.8.0, though older releases might also be impacted. The firm suggests coordinated checks with developers and vendors to determine what Praquet versions are used in production software stacks.

“If an attacker tricks a vulnerable system into reading a specially crafted Parquet file, they could gain remote code execution (RCE) on that system,” warns Endor Labs.

However, the security firm avoids over-inflating the risk by including the note, “Despite the frightening potential, it’s important to note that the vulnerability can only be exploited if a malicious Parquet file is imported.”

That being said, if upgrading to Apache Parquet 1.15.1 immediately is impossible, it is suggested to avoid untrusted Parquet files or carefully validate their safety before processing them. Also, monitoring and logging on systems that handle Parquet processing should be increased.

Although no active exploitation has been discovered yet, the risk is high due to the flaw’s severity and the widespread use of Parquet files in big data applications.

Administrators of impacted systems are recommended to upgrade to Parquet version 1.15.1, which addresses CVE-2025-30065, as soon as possible.