References https://community.cisco.com/t5/wireless/default-mywifi-cisco-com-webui-login-and-password-for-c9115axi-s/td-p/5225376 https://www.cisco.com/c/en/us/td/docs/routers/access/1100/software/configuration/xe-16-12/cisco_1100_series_swcfg_xe_16_12_x/mgmt_interfaces.html https://www.cisco.com/c/en/us/support/docs/smb/wireless/cisco-small-business-100-series-wireless-access-points/smb5499-access-the-web-based-utility-of-the-wireless-access-point-wa.html https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z https://www.cnblogs.com/0day-li/p/13663485.html https://zhuanlan.zhihu.com/p/1900556543843360889 https://cloud.tencent.com/developer/article/2359262 https://www.cisco.com/c/en/us/support/docs/field-notices/725/fn72510.html
Related VulnerabilitiesPoCCVE-2026-58123: Hermes WebUI < 0.51.788 - Remote Code ExecutionCisco ISE /admin/files-upload/ 文件上传漏洞(CVE-2025-20282)Open WebUI /api/v1/retrieval/process/web 服务器端请求伪造漏洞(CVE-2026-70485)PoCCVE-2025-20282: Cisco ISE < 3.4P2 - Unauthenticated Arbitrary File UploadPoCNginxWebUI /adminPage/login/getAuth 命令执行漏洞PoCNginxWebUI /Adminpage/Conf/loadOrg 文件读取漏洞NginxWebUI /Api/Nginx/runNginxCmd 命令执行漏洞NginxWebUI /Adminpage/Remote/cmdOver 命令执行漏洞PoCCVE-2026-44551: Open WebUI 'LDAP Empty Password' - Authentication BypassPoCCVE-2026-45397: Open WebUI < 0.9.5 - Information DisclosureOpen WebUI /api/v1/retrieval/ 信息泄露漏洞(CVE-2026-45397)Open WebUI存在信息泄露(CVE-2026-45397)PoCCVE-2024-4322: LoLLMS WebUI < 9.8 - Path Traversal