Cisco is urging network administrators to upgrade software on dozens of access point models after a bug in four IOS XE releases caused a log file to silently consume up to five-megabytes (MB) of flash storage per day, potentially leaving devices unable to install future updates or stuck in a bootloop.

The critical flaw, tracked as FN74383, sees devices running IOS XE releases 17.12.4, 17.12.5, 17.12.6, or 17.12.6a generating a steadily growing log file named cnssdaemon.log within the flash memory that slowly eats away at available flash space. The Cisco Catalyst 9130AX series and the C9124AXD Wi-Fi 6 Outdoor AP are among a long list of impacted devices.

Cisco provided the example of an affected AP's log file having ballooned to 145 MB, leaving its flash partition with just 92 MB of free space, barely above the 85 MB threshold the networking giant said is needed for an upgrade to succeed.

Worse still, the at-issue file can’t be deleted through the access point command line interface (CLI), with Cisco warning “the longer an AP runs the affected software, the higher the probability that a software download will fail due to insufficient disk space.

Cisco recommends administrators run a precheck to verify available space before attempting any upgrade, or use the company's automated WLANPoller tool to assess multiple APs at once. The firm advises network admins running those checks no more than 48 hours before any scheduled maintenance window, considering the file grows daily, and earlier results may already be out of date by the time work begins.

The ever-growing file flaw comes a few weeks after Cisco's source code, including AI codebases, was exposed in a cybersecurity breach. The vendor’s development environment was targeted as part of an ongoing supply chain brigade via a malicious GitHub automation plugin, with credentials and data among the items compromised in the attack.

This latest issue, however, was unearthed the same week the National Institute of Standards and Technology (NIST) announced it would be prioritizing analysis of certain vulnerabilities amid overwhelming numbers of issues. Only the most severe cases are set to receive full analysis, while NIST is also canning the practice of providing its own severity score for all submitted CVEs.