{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-20190", "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "state": "PUBLISHED", "assignerShortName": "cisco", "dateReserved": "2024-10-10T19:15:13.226Z", "datePublished": "2025-05-07T17:34:54.487Z", "dateUpdated": "2025-05-07T19:45:20.972Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "shortName": "cisco", "dateUpdated": "2025-05-07T17:34:54.487Z"}, "descriptions": [{"lang": "en", "value": "A vulnerability in the lobby ambassador web interface of Cisco IOS XE Wireless Controller Software could allow an authenticated, remote attacker to remove arbitrary users that are defined on an affected device.\r\n\r This vulnerability is due to insufficient access control of actions executed by lobby ambassador users. An attacker could exploit this vulnerability by logging in to an affected device with a lobby ambassador user account and sending crafted HTTP requests to the API. A successful exploit could allow the attacker to delete arbitrary user accounts on the device, including users with administrative privileges.\r\n\r Note: This vulnerability is exploitable only if the attacker obtains the credentials for a lobby ambassador account. This account is not configured by default."}], "affected": [{"vendor": "Cisco", "product": "Cisco IOS XE Software", "versions": [{"version": "17.6.8", "status": "affected"}, {"version": "17.9.6", "status": "affected"}, {"version": "17.9.6a", "status": "affected"}, {"version": "17.12.1z2", "status": "affected"}, {"version": "17.12.1z3", "status": "affected"}, {"version": "17.15.1", "status": "affected"}, {"version": "17.15.1x", "status": "affected"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Improper Access Control", "type": "cwe", "cweId": "CWE-284"}]}], "references": [{"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ewlc-user-del-hQxMpUDj", "name": "cisco-sa-ewlc-user-del-hQxMpUDj"}], "metrics": [{"format": "cvssV3_1", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "baseScore": 6.5, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "availabilityImpact": "NONE"}}], "exploits": [{"lang": "en", "value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."}], "source": {"advisory": "cisco-sa-ewlc-user-del-hQxMpUDj", "discovery": "INTERNAL", "defects": ["CSCwm35433"]}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-05-07T18:56:11.981556Z", "id": "CVE-2025-20190", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-05-07T19:45:20.972Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-20190", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-05-07T18:56:11.981556Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-05-07T18:56:13.504Z"}}], "cna": {"source": {"defects": ["CSCwm35433"], "advisory": "cisco-sa-ewlc-user-del-hQxMpUDj", "discovery": "INTERNAL"}, "metrics": [{"format": "cvssV3_1", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "Cisco", "product": "Cisco IOS XE Software", "versions": [{"status": "affected", "version": "17.6.8"}, {"status": "affected", "version": "17.9.6"}, {"status": "affected", "version": "17.9.6a"}, {"status": "affected", "version": "17.12.1z2"}, {"status": "affected", "version": "17.12.1z3"}, {"status": "affected", "version": "17.15.1"}, {"status": "affected", "version": "17.15.1x"}]}], "exploits": [{"lang": "en", "value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."}], "references": [{"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ewlc-user-del-hQxMpUDj", "name": "cisco-sa-ewlc-user-del-hQxMpUDj"}], "descriptions": [{"lang": "en", "value": "A vulnerability in the lobby ambassador web interface of Cisco IOS XE Wireless Controller Software could allow an authenticated, remote attacker to remove arbitrary users that are defined on an affected device.\r\n\r This vulnerability is due to insufficient access control of actions executed by lobby ambassador users. An attacker could exploit this vulnerability by logging in to an affected device with a lobby ambassador user account and sending crafted HTTP requests to the API. A successful exploit could allow the attacker to delete arbitrary user accounts on the device, including users with administrative privileges.\r\n\r Note: This vulnerability is exploitable only if the attacker obtains the credentials for a lobby ambassador account. This account is not configured by default."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "cwe", "cweId": "CWE-284", "description": "Improper Access Control"}]}], "providerMetadata": {"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "shortName": "cisco", "dateUpdated": "2025-05-07T17:34:54.487Z"}}}, "cveMetadata": {"cveId": "CVE-2025-20190", "state": "PUBLISHED", "dateUpdated": "2025-05-07T19:45:20.972Z", "dateReserved": "2024-10-10T19:15:13.226Z", "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "datePublished": "2025-05-07T17:34:54.487Z", "assignerShortName": "cisco"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:cisco:ios_xe:17.6.8:*:*:*:*:*:*:*", "matchCriteriaId": "2258D93E-71AA-4964-A5DF-008E3479F2A4", "vulnerable": true}, {"criteria": "cpe:2.3:o:cisco:ios_xe:17.9.6:*:*:*:*:*:*:*", "matchCriteriaId": "7BDBE176-04ED-48F0-BA9F-45BECFEDBE2A", "vulnerable": true}, {"criteria": "cpe:2.3:o:cisco:ios_xe:17.9.6a:*:*:*:*:*:*:*", "matchCriteriaId": "94E52AA0-0A77-47DF-9600-7D5B8A6D09B6", "vulnerable": true}, {"criteria": "cpe:2.3:o:cisco:ios_xe:17.12.1z2:*:*:*:*:*:*:*", "matchCriteriaId": "7E147E53-B047-429F-9E3B-04FB5F777B85", "vulnerable": true}, {"criteria": "cpe:2.3:o:cisco:ios_xe:17.12.1z3:*:*:*:*:*:*:*", "matchCriteriaId": "0656EA0A-3BB6-49AD-A6BB-922C2BC5B075", "vulnerable": true}, {"criteria": "cpe:2.3:o:cisco:ios_xe:17.15.1:*:*:*:*:*:*:*", "matchCriteriaId": "0174C08C-8846-45AE-83ED-E9964348FA28", "vulnerable": true}, {"criteria": "cpe:2.3:o:cisco:ios_xe:17.15.1x:*:*:*:*:*:*:*", "matchCriteriaId": "D4F9C74B-113E-4808-B979-7738E3A52B00", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:a:cisco:catalyst_9800-cl_wireless_controllers_for_cloud:*:*:*:*:*:*:*:*", "matchCriteriaId": "A66A48B9-2888-4D8B-A194-B67ED54990DE", "vulnerable": false}, {"criteria": "cpe:2.3:h:cisco:catalyst_9105axi:-:*:*:*:*:*:*:*", "matchCriteriaId": "19F93DF4-67DB-4B30-AC22-60C67DF32DB2", "vulnerable": false}, {"criteria": "cpe:2.3:h:cisco:catalyst_9115axe:-:*:*:*:*:*:*:*", "matchCriteriaId": "DE4C56A6-E843-498A-A17B-D3D1B01E70E7", "vulnerable": false}, {"criteria": "cpe:2.3:h:cisco:catalyst_9115axi:-:*:*:*:*:*:*:*", "matchCriteriaId": "F050F416-44C3-474C-9002-321A33F288D6", "vulnerable": false}, {"criteria": "cpe:2.3:h:cisco:catalyst_9117axi:-:*:*:*:*:*:*:*", "matchCriteriaId": "7A699C5C-CD03-4263-952F-5074B470F20E", "vulnerable": false}, {"criteria": "cpe:2.3:h:cisco:catalyst_9120axe:-:*:*:*:*:*:*:*", "matchCriteriaId": "46D41CFE-784B-40EE-9431-8097428E5892", "vulnerable": false}, {"criteria": "cpe:2.3:h:cisco:catalyst_9120axi:-:*:*:*:*:*:*:*", "matchCriteriaId": "5D148A27-85B6-4883-96B5-343C8D32F23B", "vulnerable": false}, {"criteria": "cpe:2.3:h:cisco:catalyst_9120axp:-:*:*:*:*:*:*:*", "matchCriteriaId": "735CA950-672C-4787-8910-48AD07868FDE", "vulnerable": false}, {"criteria": "cpe:2.3:h:cisco:catalyst_9130axe:-:*:*:*:*:*:*:*", "matchCriteriaId": "4EC1F736-6240-4FA2-9FEC-D8798C9D287C", "vulnerable": false}, {"criteria": "cpe:2.3:h:cisco:catalyst_9130axi:-:*:*:*:*:*:*:*", "matchCriteriaId": "169E5354-07EA-4639-AB4B-20D2B9DE784C", "vulnerable": false}, {"criteria": "cpe:2.3:h:cisco:catalyst_9800-40:-:*:*:*:*:*:*:*", "matchCriteriaId": "1B9ED0E5-CB20-4106-9CF2-8EB587B33543", "vulnerable": false}, {"criteria": "cpe:2.3:h:cisco:catalyst_9800-80:-:*:*:*:*:*:*:*", "matchCriteriaId": "2B0E620C-8E09-4F7C-A326-26013173B993", "vulnerable": false}, {"criteria": "cpe:2.3:h:cisco:catalyst_9800-l:-:*:*:*:*:*:*:*", "matchCriteriaId": "2E0BA345-B7D7-4975-9199-4DC7875BBFD0", "vulnerable": false}, {"criteria": "cpe:2.3:h:cisco:catalyst_cw9800h1:-:*:*:*:*:*:*:*", "matchCriteriaId": "F4AA835E-2757-485B-8CE7-3D5BFD97C5D0", "vulnerable": false}, {"criteria": "cpe:2.3:h:cisco:catalyst_cw9800h2:-:*:*:*:*:*:*:*", "matchCriteriaId": "E4D63B25-1CA7-44D4-AD74-99CB4A2DA647", "vulnerable": false}, {"criteria": "cpe:2.3:h:cisco:catalyst_cw9800m:-:*:*:*:*:*:*:*", "matchCriteriaId": "E915BC3D-8837-4FDA-B5D3-F465DB66D1C5", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability in the lobby ambassador web interface of Cisco IOS XE Wireless Controller Software could allow an authenticated, remote attacker to remove arbitrary users that are defined on an affected device.\r\n\r This vulnerability is due to insufficient access control of actions executed by lobby ambassador users. An attacker could exploit this vulnerability by logging in to an affected device with a lobby ambassador user account and sending crafted HTTP requests to the API. A successful exploit could allow the attacker to delete arbitrary user accounts on the device, including users with administrative privileges.\r\n\r Note: This vulnerability is exploitable only if the attacker obtains the credentials for a lobby ambassador account. This account is not configured by default."}, {"lang": "es", "value": "Una vulnerabilidad en la interfaz web de embajador de lobby del software del controlador inal\u00e1mbrico Cisco IOS XE podr\u00eda permitir que un atacante remoto autenticado elimine usuarios arbitrarios definidos en un dispositivo afectado. Esta vulnerabilidad se debe a un control de acceso insuficiente para las acciones ejecutadas por los usuarios de embajador de lobby. Un atacante podr\u00eda explotar esta vulnerabilidad iniciando sesi\u00f3n en un dispositivo afectado con una cuenta de usuario de embajador de lobby y enviando solicitudes HTTP manipuladas a la API. Una explotaci\u00f3n exitosa podr\u00eda permitir al atacante eliminar cuentas de usuario arbitrarias en el dispositivo, incluyendo usuarios con privilegios administrativos. Nota: Esta vulnerabilidad solo es explotable si el atacante obtiene las credenciales de una cuenta de embajador de lobby. Esta cuenta no est\u00e1 configurada por defecto."}], "id": "CVE-2025-20190", "lastModified": "2025-07-31T15:48:08.890", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "[email protected]", "type": "Primary"}]}, "published": "2025-05-07T18:15:38.963", "references": [{"source": "[email protected]", "tags": ["Vendor Advisory"], "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ewlc-user-del-hQxMpUDj"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-284"}], "source": "[email protected]", "type": "Primary"}]}

{}