CVE-2025-20190 Missing authorization in Cisco IOS XE Software

Medium 6.5 Published 7 May 2025 Updated 7 May 2025

Authenticated lobby ambassador users can delete arbitrary accounts, including admins, due to insufficient access control in the web interface.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2025-20190?

CVE-2025-20190 is a medium-severity missing authorization vulnerability in Cisco Ios Xe, published on 7 May 2025. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

A vulnerability in the lobby ambassador web interface of Cisco IOS XE Wireless Controller Software could allow an authenticated, remote attacker to remove arbitrary users that are defined on an affected device. This vulnerability is due to insufficient access control of actions executed by lobby ambassador users. An attacker could exploit this vulnerability by logging in to an affected device with a lobby ambassador user account and sending crafted HTTP requests to the API. A successful exploit could allow the attacker to delete arbitrary user accounts on the device, including users with administrative privileges. Note: This vulnerability is exploitable only if the attacker obtains the credentials for a lobby ambassador account. This account is not configured by default.

Weakness: CWE-284

Which versions are affected by CVE-2025-20190?

It affects 1 product.

Products include Cisco Ios Xe.

How do I fix CVE-2025-20190?

No fix has been published for CVE-2025-20190 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2025-20190 being exploited?

There is no known exploitation of CVE-2025-20190 in the wild and no public exploit code.

All Cisco Ios Xe vulnerabilities

Sources

Also known as GHSA-q4xx-mxw3-33fm.