A malformed CAPWAP packet can be sent to a Cisco IOS XE Wireless Controller (Catalyst CW9800 Family) by an unauthenticated remote attacker. The improper parsing of such packets causes the device to reload unexpectedly, resulting in a denial of service. This weakness is categorized as CWE‑230, reflecting improper input validation that leads to system destabilization.

The flaw affects Cisco IOS XE Wireless Controller Software deployed on Catalyst CW9800 wireless controllers. No specific software versions are listed in the advisory, so all deployments of this controller family running the vulnerable software are potentially exposed.

The vulnerability is scored CVSS 8.6, indicating high severity, and it is not yet listed in the CISA KEV catalog. Because the attack vector is remote and requires no authentication, the likelihood of exploitation is significant in environments where the controller is accessible over a network. The lack of known mitigation steps in the advisory suggests that a vendor patch is the preferred response.