https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 21:38:24 +0000 https://cve.radiocsirt.org/vuln/bdu:2025-10336 bdu:2025-10336 https://cve.radiocsirt.org/vuln/bdu:2025-10336 https://cve.radiocsirt.org/vuln/cisco-sa-ewlc-user-del-hqxmpudj <p>A vulnerability in the lobby ambassador web interface of Cisco IOS XE Wireless Controller Software could allow an authenticated, remote attacker to remove arbitrary users that are defined on an affected device. This vulnerability is due to insufficient access control of actions executed by lobby ambassador users. An attacker could exploit this vulnerability by logging in to an affected device with a lobby ambassador user account and sending crafted HTTP requests to the API. A successful exploit could allow the attacker to delete arbitrary user accounts on the device, including users with administrative privileges. Note: This vulnerability is exploitable only if the attacker obtains the credentials for a lobby ambassador account. This account is not configured by default. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is part of the May 2025 release of the Cisco IOS and IOS XE Software Security Advisory Bundled Publication. For a complete list of the advisories and links to them, see Cisco Event Response: May 2025 Semiannual Cisco IOS and IOS XE Software Security Advisory Bundled Publication [&#34;https://sec.cloudapps.cisco.com/security/center/viewErp.x?alertId=ERP-75279&#34;].</p> <p>A vulnerability in the lobby ambassador web interface of Cisco IOS XE Wireless Controller Software could allow an authenticated, remote attacker to remove arbitrary users that are defined on an affected device. This vulnerability is due to insufficient access control of actions executed by lobby ambassador users. An attacker could exploit this vulnerability by logging in to an affected device with a lobby ambassador user account and sending crafted HTTP requests to the API. A successful exploit could allow the attacker to delete arbitrary user accounts on the device, including users with administrative privileges. Note: This vulnerability is exploitable only if the attacker obtains the credentials for a lobby ambassador account. This account is not configured by default. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is part of the May 2025 release of the Cisco IOS and IOS XE Software Security Advisory Bundled Publication. For a complete list of the advisories and links to them, see Cisco Event Response: May 2025 Semiannual Cisco IOS and IOS XE Software Security Advisory Bundled Publication [&#34;https://sec.cloudapps.cisco.com/security/center/viewErp.x?alertId=ERP-75279&#34;].</p> https://cve.radiocsirt.org/vuln/cisco-sa-ewlc-user-del-hqxmpudj https://cve.radiocsirt.org/vuln/euvd-2026-238296 EUVD-2026-238296 https://cve.radiocsirt.org/vuln/euvd-2026-238296 https://cve.radiocsirt.org/vuln/fkie_cve-2025-20190 <p>A vulnerability in the lobby ambassador web interface of Cisco IOS XE Wireless Controller Software could allow an authenticated, remote attacker to remove arbitrary users that are defined on an affected device. This vulnerability is due to insufficient access control of actions executed by lobby ambassador users. An attacker could exploit this vulnerability by logging in to an affected device with a lobby ambassador user account and sending crafted HTTP requests to the API. A successful exploit could allow the attacker to delete arbitrary user accounts on the device, including users with administrative privileges. Note: This vulnerability is exploitable only if the attacker obtains the credentials for a lobby ambassador account. This account is not configured by default.</p> <p>A vulnerability in the lobby ambassador web interface of Cisco IOS XE Wireless Controller Software could allow an authenticated, remote attacker to remove arbitrary users that are defined on an affected device. This vulnerability is due to insufficient access control of actions executed by lobby ambassador users. An attacker could exploit this vulnerability by logging in to an affected device with a lobby ambassador user account and sending crafted HTTP requests to the API. A successful exploit could allow the attacker to delete arbitrary user accounts on the device, including users with administrative privileges. Note: This vulnerability is exploitable only if the attacker obtains the credentials for a lobby ambassador account. This account is not configured by default.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-20190 https://cve.radiocsirt.org/vuln/ghsa-q4xx-mxw3-33fm <p>A vulnerability in the lobby ambassador web interface of Cisco IOS XE Wireless Controller Software could allow an authenticated, remote attacker to remove arbitrary users that are defined on an affected device.</p> <p>This vulnerability is due to insufficient access control of actions executed by lobby ambassador users. An attacker could exploit this vulnerability by logging in to an affected device with a lobby ambassador user account and sending crafted HTTP requests to the API. A successful exploit could allow the attacker to delete arbitrary user accounts on the device, including users with administrative privileges.</p> <p>Note: This vulnerability is exploitable only if the attacker obtains the credentials for a lobby ambassador account. This account is not configured by default.</p> <p>A vulnerability in the lobby ambassador web interface of Cisco IOS XE Wireless Controller Software could allow an authenticated, remote attacker to remove arbitrary users that are defined on an affected device.</p> <p>This vulnerability is due to insufficient access control of actions executed by lobby ambassador users. An attacker could exploit this vulnerability by logging in to an affected device with a lobby ambassador user account and sending crafted HTTP requests to the API. A successful exploit could allow the attacker to delete arbitrary user accounts on the device, including users with administrative privileges.</p> <p>Note: This vulnerability is exploitable only if the attacker obtains the credentials for a lobby ambassador account. This account is not configured by default.</p> https://cve.radiocsirt.org/vuln/ghsa-q4xx-mxw3-33fm https://cve.radiocsirt.org/vuln/wid-sec-w-2025-0971 <p>Ein Angreifer kann mehrere Schwachstellen in Cisco IOS XE Wireless Controllern ausnutzen, um beliebigen Programmcode mit Administratorrechten auszuführen, beliebige Nutzerkonten zu löschen oder einen Denial of Service zu verursachen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in Cisco IOS XE Wireless Controllern ausnutzen, um beliebigen Programmcode mit Administratorrechten auszuführen, beliebige Nutzerkonten zu löschen oder einen Denial of Service zu verursachen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2025-0971