PT-2025-20262 · Cisco · Cisco Ios Xe Wireless Controller+1

Published 2025-05-07 · Updated 2025-05-07 · CVE-2025-20190

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions Cisco IOS XE Wireless Controller Software (affected versions not specified)

Description A vulnerability in the lobby ambassador web interface could allow an authenticated, remote attacker to remove arbitrary users that are defined on an affected device. This issue is due to insufficient access control of actions executed by lobby ambassador users. An attacker could exploit this by logging in with a lobby ambassador user account and sending crafted HTTP requests to the API, potentially allowing the deletion of arbitrary user accounts, including those with administrative privileges. Note that this vulnerability is exploitable only if the attacker obtains the credentials for a lobby ambassador account, which is not configured by default.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

BDU:2025-10336

CVE-2025-20190

Affected Products

Cisco Ios Xe Wireless Controller

Cisco Ios Xe

References · 5

• https://bdu.fstec.ru/vul/2025-10336 · Security Note
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ewlc-user-del-hQxMpUDj · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-20190 · Security Note
• https://osv.dev/vulnerability/CVE-2025-20190 · Vendor Advisory
• https://twitter.com/CVEnew/status/1920246413293649935 · Twitter Post