CVE-2025-20186 Details
Description
A vulnerability in the web-based management interface of the Wireless LAN Controller feature of Cisco IOS XE Software could allow an authenticated, remote attacker with a lobby ambassador user account to perform a command injection attack against an affected device. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending crafted input to the web-based management interface. A successful exploit could allow the attacker to execute arbitrary Cisco IOS XE Software CLI commands with privilege level 15. Note: This vulnerability is exploitable only if the attacker obtains the credentials for a lobby ambassador account. This account is not configured by default.
A command injection vulnerability has been identified in the web-based management interface of the Wireless LAN Controller feature in Cisco IOS XE Software. This vulnerability allows an authenticated, remote attacker with a lobby ambassador user account to execute arbitrary Cisco IOS XE Software CLI commands with privilege level 15. The issue arises from insufficient input validation, enabling the attacker to send crafted input to the management interface. Exploitation is possible only if the attacker has obtained credentials for a lobby ambassador account, which is not configured by default.
Cisco has released free software updates to address this vulnerability. Customers with service contracts that include regular software updates should obtain the security fixes through their usual channels. For those without service contracts, contact the Cisco Technical Assistance Center (TAC) for assistance. To determine exposure to this vulnerability, use the Cisco Software Checker tool.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 8, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webui-cmdinj-gVn3OKNC | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| cisco ios xe | 16.12.4 16.12.4a 16.12.5 16.12.6 16.12.6a 16.12.7 16.12.8 17.2.2 17.2.3 17.3.1 17.3.1a 17.3.2 17.3.2a 17.3.3 17.3.4 17.3.4a 17.3.4c 17.3.5 17.3.5a 17.3.5b 17.3.6 17.3.7 17.3.8 17.3.8a 17.4.1 17.4.1a 17.4.1b 17.4.2 17.5.1 17.5.1a 17.6.1 17.6.1a 17.6.1y 17.6.2 17.6.3 17.6.3a 17.6.4 17.6.5 17.6.5a 17.6.6 17.6.6a 17.6.7 17.7.1 17.7.1a 17.7.2 17.8.1 17.8.1a 17.9.1 17.9.1a 17.9.2 17.9.2a 17.9.3 17.9.3a 17.9.4 17.9.4a 17.9.5 17.9.5a 17.9.5b 17.9.5e 17.9.5f 17.10.1 17.10.1a 17.11.1 17.11.1a 17.12.1 17.12.1a 17.12.2 17.12.3 17.12.3a 17.12.4 17.12.4a 17.12.4b 17.13.1 17.13.1a 17.14.1 17.14.1a |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jul 11, 2025 | Initial Analysis | [email protected] |
| May 7, 2025 | New CVE Received | [email protected] |