CVE-2025-20190 (GCVE-0-2025-20190)

Vulnerability from cvelistv5 – Published: 2025-05-07 17:34 – Updated: 2025-05-07 19:45
VLAI?
Summary
A vulnerability in the lobby ambassador web interface of Cisco IOS XE Wireless Controller Software could allow an authenticated, remote attacker to remove arbitrary users that are defined on an affected device. This vulnerability is due to insufficient access control of actions executed by lobby ambassador users. An attacker could exploit this vulnerability by logging in to an affected device with a lobby ambassador user account and sending crafted HTTP requests to the API. A successful exploit could allow the attacker to delete arbitrary user accounts on the device, including users with administrative privileges. Note: This vulnerability is exploitable only if the attacker obtains the credentials for a lobby ambassador account. This account is not configured by default.
Severity ?
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
CWE
  • CWE-284 - Improper Access Control
Assigner
References
Impacted products
Vendor Product Version
Cisco Cisco IOS XE Software Affected: 17.6.8
Affected: 17.9.6
Affected: 17.9.6a
Affected: 17.12.1z2
Affected: 17.12.1z3
Affected: 17.15.1
Affected: 17.15.1x
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-20190",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-07T18:56:11.981556Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-07T19:45:20.972Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Cisco IOS XE Software",
          "vendor": "Cisco",
          "versions": [
            {
              "status": "affected",
              "version": "17.6.8"
            },
            {
              "status": "affected",
              "version": "17.9.6"
            },
            {
              "status": "affected",
              "version": "17.9.6a"
            },
            {
              "status": "affected",
              "version": "17.12.1z2"
            },
            {
              "status": "affected",
              "version": "17.12.1z3"
            },
            {
              "status": "affected",
              "version": "17.15.1"
            },
            {
              "status": "affected",
              "version": "17.15.1x"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability in the lobby ambassador web interface of Cisco IOS XE Wireless Controller Software could allow an authenticated, remote attacker to remove arbitrary users that are defined on an affected device.\r\n\r This vulnerability is due to insufficient access control of actions executed by lobby ambassador users. An attacker could exploit this vulnerability by logging in to an affected device with a lobby ambassador user account and sending crafted HTTP requests to the API. A successful exploit could allow the attacker to delete arbitrary user accounts on the device, including users with administrative privileges.\r\n\r Note: This vulnerability is exploitable only if the attacker obtains the credentials for a lobby ambassador account. This account is not configured by default."
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "format": "cvssV3_1"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "Improper Access Control",
              "lang": "en",
              "type": "cwe"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-07T17:34:54.487Z",
        "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
        "shortName": "cisco"
      },
      "references": [
        {
          "name": "cisco-sa-ewlc-user-del-hQxMpUDj",
          "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ewlc-user-del-hQxMpUDj"
        }
      ],
      "source": {
        "advisory": "cisco-sa-ewlc-user-del-hQxMpUDj",
        "defects": [
          "CSCwm35433"
        ],
        "discovery": "INTERNAL"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
    "assignerShortName": "cisco",
    "cveId": "CVE-2025-20190",
    "datePublished": "2025-05-07T17:34:54.487Z",
    "dateReserved": "2024-10-10T19:15:13.226Z",
    "dateUpdated": "2025-05-07T19:45:20.972Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-20190\",\"sourceIdentifier\":\"psirt@cisco.com\",\"published\":\"2025-05-07T18:15:38.963\",\"lastModified\":\"2025-07-31T15:48:08.890\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A vulnerability in the lobby ambassador web interface of Cisco IOS XE Wireless Controller Software could allow an authenticated, remote attacker to remove arbitrary users that are defined on an affected device.\\r\\n\\r This vulnerability is due to insufficient access control of actions executed by lobby ambassador users. An attacker could exploit this vulnerability by logging in to an affected device with a lobby ambassador user account and sending crafted HTTP requests to the API. A successful exploit could allow the attacker to delete arbitrary user accounts on the device, including users with administrative privileges.\\r\\n\\r Note: This vulnerability is exploitable only if the attacker obtains the credentials for a lobby ambassador account. This account is not configured by default.\"},{\"lang\":\"es\",\"value\":\"Una vulnerabilidad en la interfaz web de embajador de lobby del software del controlador inal\u00e1mbrico Cisco IOS XE podr\u00eda permitir que un atacante remoto autenticado elimine usuarios arbitrarios definidos en un dispositivo afectado. Esta vulnerabilidad se debe a un control de acceso insuficiente para las acciones ejecutadas por los usuarios de embajador de lobby. Un atacante podr\u00eda explotar esta vulnerabilidad iniciando sesi\u00f3n en un dispositivo afectado con una cuenta de usuario de embajador de lobby y enviando solicitudes HTTP manipuladas a la API. Una explotaci\u00f3n exitosa podr\u00eda permitir al atacante eliminar cuentas de usuario arbitrarias en el dispositivo, incluyendo usuarios con privilegios administrativos. Nota: Esta vulnerabilidad solo es explotable si el atacante obtiene las credenciales de una cuenta de embajador de lobby. Esta cuenta no est\u00e1 configurada por defecto.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"psirt@cisco.com\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N\",\"baseScore\":6.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"psirt@cisco.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-284\"}]}],\"configurations\":[{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:cisco:ios_xe:17.6.8:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2258D93E-71AA-4964-A5DF-008E3479F2A4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:cisco:ios_xe:17.9.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7BDBE176-04ED-48F0-BA9F-45BECFEDBE2A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:cisco:ios_xe:17.9.6a:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"94E52AA0-0A77-47DF-9600-7D5B8A6D09B6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:cisco:ios_xe:17.12.1z2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7E147E53-B047-429F-9E3B-04FB5F777B85\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:cisco:ios_xe:17.12.1z3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0656EA0A-3BB6-49AD-A6BB-922C2BC5B075\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:cisco:ios_xe:17.15.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0174C08C-8846-45AE-83ED-E9964348FA28\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:cisco:ios_xe:17.15.1x:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D4F9C74B-113E-4808-B979-7738E3A52B00\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:cisco:catalyst_9800-cl_wireless_controllers_for_cloud:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A66A48B9-2888-4D8B-A194-B67ED54990DE\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:cisco:catalyst_9105axi:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"19F93DF4-67DB-4B30-AC22-60C67DF32DB2\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:cisco:catalyst_9115axe:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DE4C56A6-E843-498A-A17B-D3D1B01E70E7\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:cisco:catalyst_9115axi:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F050F416-44C3-474C-9002-321A33F288D6\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:cisco:catalyst_9117axi:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7A699C5C-CD03-4263-952F-5074B470F20E\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:cisco:catalyst_9120axe:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"46D41CFE-784B-40EE-9431-8097428E5892\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:cisco:catalyst_9120axi:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5D148A27-85B6-4883-96B5-343C8D32F23B\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:cisco:catalyst_9120axp:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"735CA950-672C-4787-8910-48AD07868FDE\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:cisco:catalyst_9130axe:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4EC1F736-6240-4FA2-9FEC-D8798C9D287C\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:cisco:catalyst_9130axi:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"169E5354-07EA-4639-AB4B-20D2B9DE784C\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:cisco:catalyst_9800-40:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1B9ED0E5-CB20-4106-9CF2-8EB587B33543\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:cisco:catalyst_9800-80:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2B0E620C-8E09-4F7C-A326-26013173B993\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:cisco:catalyst_9800-l:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2E0BA345-B7D7-4975-9199-4DC7875BBFD0\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:cisco:catalyst_cw9800h1:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F4AA835E-2757-485B-8CE7-3D5BFD97C5D0\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:cisco:catalyst_cw9800h2:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E4D63B25-1CA7-44D4-AD74-99CB4A2DA647\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:cisco:catalyst_cw9800m:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E915BC3D-8837-4FDA-B5D3-F465DB66D1C5\"}]}]}],\"references\":[{\"url\":\"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ewlc-user-del-hQxMpUDj\",\"source\":\"psirt@cisco.com\",\"tags\":[\"Vendor Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-20190\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-05-07T18:56:11.981556Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-05-07T18:56:13.504Z\"}}], \"cna\": {\"source\": {\"defects\": [\"CSCwm35433\"], \"advisory\": \"cisco-sa-ewlc-user-del-hQxMpUDj\", \"discovery\": \"INTERNAL\"}, \"metrics\": [{\"format\": \"cvssV3_1\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 6.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"NONE\"}}], \"affected\": [{\"vendor\": \"Cisco\", \"product\": \"Cisco IOS XE Software\", \"versions\": [{\"status\": \"affected\", \"version\": \"17.6.8\"}, {\"status\": \"affected\", \"version\": \"17.9.6\"}, {\"status\": \"affected\", \"version\": \"17.9.6a\"}, {\"status\": \"affected\", \"version\": \"17.12.1z2\"}, {\"status\": \"affected\", \"version\": \"17.12.1z3\"}, {\"status\": \"affected\", \"version\": \"17.15.1\"}, {\"status\": \"affected\", \"version\": \"17.15.1x\"}]}], \"exploits\": [{\"lang\": \"en\", \"value\": \"The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory.\"}], \"references\": [{\"url\": \"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ewlc-user-del-hQxMpUDj\", \"name\": \"cisco-sa-ewlc-user-del-hQxMpUDj\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"A vulnerability in the lobby ambassador web interface of Cisco IOS XE Wireless Controller Software could allow an authenticated, remote attacker to remove arbitrary users that are defined on an affected device.\\r\\n\\r This vulnerability is due to insufficient access control of actions executed by lobby ambassador users. An attacker could exploit this vulnerability by logging in to an affected device with a lobby ambassador user account and sending crafted HTTP requests to the API. A successful exploit could allow the attacker to delete arbitrary user accounts on the device, including users with administrative privileges.\\r\\n\\r Note: This vulnerability is exploitable only if the attacker obtains the credentials for a lobby ambassador account. This account is not configured by default.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"cwe\", \"cweId\": \"CWE-284\", \"description\": \"Improper Access Control\"}]}], \"providerMetadata\": {\"orgId\": \"d1c1063e-7a18-46af-9102-31f8928bc633\", \"shortName\": \"cisco\", \"dateUpdated\": \"2025-05-07T17:34:54.487Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-20190\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-05-07T19:45:20.972Z\", \"dateReserved\": \"2024-10-10T19:15:13.226Z\", \"assignerOrgId\": \"d1c1063e-7a18-46af-9102-31f8928bc633\", \"datePublished\": \"2025-05-07T17:34:54.487Z\", \"assignerShortName\": \"cisco\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.