CVE-2025-20186
Published: 07 May 2025
Summary
CVE-2025-20186 is a high-severity OS Command Injection (CWE-78) vulnerability in Cisco Ios Xe. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 20.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
A vulnerability in the web-based management interface of the Wireless LAN Controller feature of Cisco IOS XE Software could allow an authenticated remote attacker to perform command injection. The issue stems from insufficient input validation and is tracked as CWE-78 with a CVSS 3.1 score of 8.8. Exploitation requires a valid lobby ambassador account, which is not present by default, and permits execution of arbitrary CLI commands at privilege level 15 on affected devices.
An attacker who obtains lobby ambassador credentials can send crafted input through the management interface to inject and run commands. This grants full control over the device configuration and operations without needing additional privileges or user interaction.
The referenced Cisco Security Advisory at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webui-cmdinj-gVn3OKNC provides official guidance on mitigation steps and affected releases. The EPSS score remains flat at a low 0.0120 with no observed rise after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-13897
Vulnerability details
A vulnerability in the web-based management interface of the Wireless LAN Controller feature of Cisco IOS XE Software could allow an authenticated, remote attacker with a lobby ambassador user account to perform a command injection attack against an affected device.…
more
This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending crafted input to the web-based management interface. A successful exploit could allow the attacker to execute arbitrary Cisco IOS XE Software CLI commands with privilege level 15. Note: This vulnerability is exploitable only if the attacker obtains the credentials for a lobby ambassador account. This account is not configured by default.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.