CSCvc36452 - Passwd on AireOS are hashed with PS_STATIC_AES128CBC_SHA1

[itkcisco1]

The passwords are not hashed; they are just encrypted. The MAC field is just a HMAC protecting the _encrypted_ data; what you want is the iv and passwd fields. The static AES-128-CBC key (presumably what “PS_STATIC” is referring to, I haven't seen a “PS_USER” or “PS_DEVICE” password in the wild) is 834156f9940f09c0a8d00f019f850005, the same used to protect the passwords in “show run” (you can find it a couple of places online, including scripts to decrypt).

So beware, if someone manages to get of the CF card in the controller, you will want to change the password immediately.

[Rich R · Accepted solution]

If someone has physical access to your WLCs I think you have much bigger problems than just the passwords.
Note that that is a problem in AireOS, which is now end of life.
If you still have WLCs running AireOS you should be planning to migrate to 9800 or cloud based current technology.