First: what version of code are you running? 17.09 is not a version number, it's a release train. An actual release of IOS-XE will have a third digit 17.9.x? It's always important to specify exactly which version of code you're running.
That said - updating your code is unlikely to make any difference. This is a very old vulnerability related to RSA key exchange which was addressed in affected Cisco products by https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-20171212-bleichenbacher.html back in 2017/2018. What you are reporting is probably a false positive detection caused by RSA key exchange being enabled on the WLC probably with a long life (5 or 10 year) self-signed certificate which the scanner cannot verify.
Analysis for 9800 would probably look the same as this bug which was raised for Telepresence:
https://bst.cisco.com/bugsearch/bug/CSCvi05672
So:
1. Get a CLEAR analysis of EXACTLY what your security team actually detected. If they just say the scanner detected the vulnerability without any explanation then chances are the person you are talking to has no understanding of the details and you need to DEMAND a detailed technical analysis of what they are seeing and claiming. If they can't give you that then tell them it's a false positive detection and to fix their scanner or come back to you with the actual details.
2. What can you do to address the false positive detection from your side?
- Use a proper 1 year certificate issued by a registered public Certificate Authority which the scanner can verify
- If possible use an EC certificate not an RSA certificate
https://www.cisco.com/c/en/us/td/docs/wireless/controller/9800/17-9/config-guide/b_wl_17_9_cg/m_certificate_management_gui.html#Cisco_Task_in_List_GUI.dita_caf25755-8771-48b1-a09c-8bc06b42a151
Also refer to the Best Practice guide for configuring secure web access:
https://www.cisco.com/c/en/us/products/collateral/wireless/catalyst-9800-series-wireless-controllers/guide-c07-743627.html#Enablesecurewebaccess
Make sure to set TLSv1.2 and your security team's recommended choice of "ip http secure-ciphersuite"
For example many FIPS guides recommend "ip http secure-ciphersuite aes-128-cbc-sha" or "ip http secure-ciphersuite aes-256-cbc-sha"
