CVE-2025-20140

A vulnerability in the Wireless Network Control daemon (wncd) of Cisco IOS XE Software for Wireless LAN Controllers (WLCs) could allow an unauthenticated, adjacent wireless attacker to cause a denial of service (DoS) condition. This vulnerability is due to improper memory management. An attacker could exploit this vulnerability by sending a series of IPv6 network requests from an associated wireless IPv6 client to an affected device. To associate a client to a device, an attacker may first need to authenticate to the network, or associate freely in the case of a configured open network. A successful exploit could allow the attacker to cause the wncd process to consume available memory and eventually cause the device to stop responding, resulting in a DoS condition.

• CWE-789

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-wlc-wncd-p6Gvt6HLVendor Advisory

Published

May 7, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-20135A vulnerability in the DHCP client functionality of Cisco Se…4.3
• CVE-2025-20136A vulnerability in the function that performs IPv4 and IPv6 …8.6
• CVE-2025-20137A vulnerability in the access control list (ACL) programming…4.7
• CVE-2025-20138A vulnerability in the CLI of Cisco IOS XR Software could al…8.8
• CVE-2025-20139A vulnerability in chat messaging features of Cisco Enterpri…7.5
• CVE-2025-2014Ashlar-Vellum Cobalt VS File Parsing Use of Uninitialized Va…7.8
• CVE-2025-20141A vulnerability in the handling of specific packets that are…7.4
• CVE-2025-20142A vulnerability in the IPv4 access control list (ACL) featur…8.6
• CVE-2025-20143A vulnerability in the boot process of Cisco IOS XR Software…6.7
• CVE-2025-20144A vulnerability in the hybrid access control list (ACL) proc…5.8
• CVE-2025-20145A vulnerability in the access control list (ACL) processing …5.8
• CVE-2025-20146A vulnerability in the Layer 3 multicast feature of Cisco IO…8.6