EUVD-2026-15445
GHSA-3855-fjjh-9xh2
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Hardware access control granularity
|
| Impact | Multiple intelligence sources paint a nuanced risk picture. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) indicates network accessibility with low attack complexity but mandatory prior authentication (PR:L), resulting in a 5.4 base score. However, the SSVC decision framework from CISA is more revealing: exploitation status is 'none' (not yet observed in the wild), the attack is not automatable (requires manual crafting of requests), and technical impact is only partial (limited to confidentiality and integrity, not availability). This divergence suggests the CVSS score reflects potential impact rather than actual threat likelihood. The ENISA EUVD listing confirms the vulnerability's formal recognition but does not indicate active exploitation campaigns. The vulnerability requires prior authentication as a Lobby Ambassador user, which is a significant barrier; the attacker must already have legitimate access credentials for that role. Organizations with strict network segmentation, authentication controls, and privileged access management (PAM) solutions face lower risk than those with permissive Lobby Ambassador role assignments. This is a medium-severity issue requiring patch prioritization but not an immediate critical threat. |
| Exploit ScenarioDerived | An employee with Lobby Ambassador credentials (perhaps a junior network administrator or third-party support vendor) authenticates to the web-based management API of a Cisco IOS XE device. The attacker crafts a specially formatted HTTP request to the API endpoint responsible for user management, omitting or manipulating validation parameters that normally restrict user creation to lower-privilege accounts. The API processes the malformed request without proper validation and creates a new administrative user account with privilege level 1 access. The attacker then disconnects their Lobby Ambassador session and re-authenticates using the newly created administrative account, gaining full management access to the device and potentially other network infrastructure accessible from that management plane. This scenario is plausible given the low attack complexity and does not require exploitation tools beyond standard HTTP clients, though no public POC has been reported. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 25, 2026
Insufficient parameter validation in Cisco IOS XE Software's Lobby Ambassador management API allows authenticated remote attackers to bypass access controls and create unauthorized administrative accounts. An attacker with standard Lobby Ambassador credentials can exploit this flaw to escalate privileges and gain full management API access on affected devices. This impacts Cisco and Apple products and currently has no available patch.
Earlier versions of this analysis (1)
A privilege escalation vulnerability exists in the Lobby Ambassador web-based management API of Cisco IOS XE Software due to insufficient parameter validation in an API endpoint. An authenticated attacker with Lobby Ambassador user privileges can craft a malicious HTTP request to create a new user account with privilege level 1 access, effectively bypassing normal access controls and escalating their permissions. While the CVSS score of 5.4 indicates medium severity, the SSVC framework indicates no active exploitation has been detected, the vulnerability is not automatable, and technical impact is only partial, suggesting this is a lower real-world priority than the base score alone might indicate.
RemediationAI
Upgrade Cisco IOS XE Software to a patched version released after the advisory publication date (consult https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-lobby-privesc-KwxBqJy for specific fixed versions per major release line). Until patching is complete, implement restrictive network access controls by limiting access to the web-based management API to trusted administrative subnets and VPN endpoints only, enforce mutual TLS (mTLS) for API communications if supported, and review and minimize the number of accounts granted Lobby Ambassador privileges using the principle of least privilege. Additionally, implement robust logging and alerting on API endpoint activity, specifically monitoring for user creation requests from Lobby Ambassador sessions, and consider implementing API rate limiting or request filtering to block suspicious parameter combinations. If available, consult Cisco TAC for interim guidance on disabling the Lobby Ambassador role if it is not actively required in your environment.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in Cisco IOS XE Software's web-based management API, specifically the Lobby Ambassador component which provides limited administrative functionality. The root cause is classified under CWE-1286 (Improper Validation of Syntactic Correctness of Input), meaning the API endpoint receives and processes user-supplied parameters without adequate validation or sanitization before using them in privileged operations such as user creation. The Lobby Ambassador role is designed as a limited-privilege administrative role, but the lack of parameter validation allows attackers to bypass role-based access control (RBAC) enforcement. This affects Cisco IOS XE Software across multiple major versions from 16.11 through 17.18, as identified via the CPE specification cpe:2.3:a:cisco:cisco_ios_xe_software. The vulnerability requires authentication as a Lobby Ambassador user, meaning it cannot be exploited by unauthenticated network attackers, which limits its attack surface.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionCVE.org
A vulnerability in the Lobby Ambassador web-based management API of Cisco IOS XE Software could allow an authenticated, remote attacker to elevate their privileges and access management APIs that would not normally be available for Lobby Ambassador users. This vulnerability exists because parameters that are received by an API endpoint are not sufficiently validated. An attacker could exploit this vulnerability by authenticating as a Lobby Ambassador user and sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to create a new user with privilege level 1 access to the web-based management API. The attacker would then be able to access the device with these new credentials and privileges.
Executive ViewAI
CVE-2026-20114 presents moderate security risk rated CVSS 5.4. Exploitation could compromise the security of affected deployments. Organizations should apply vendor updates when available and monitor for exploitation.
Apply vendor patch. If patching is delayed: restrict network access and enable monitoring.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB