Is CVE-2025-20186 being actively exploited?

CVE-2025-20186 is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

What is the CVSS score for CVE-2025-20186?

CVE-2025-20186 has a CVSS 3.1 base score of 8.8 (HIGH).

CVE-2025-20186

HIGH · CVSS 8.8EPSS 0.9%EU EUVD

A vulnerability in the web-based management interface of the Wireless LAN Controller feature of Cisco IOS XE Software could allow an authenticated, remote attacker with a lobby ambassador user account to perform a command injection attack against an affected device. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending crafted input to the web-based management interface. A successful exploit could allow the attacker to execute arbitrary Cisco IOS XE Software CLI commands with privilege level 15. Note: This vulnerability is exploitable only if the attacker obtains the credentials for a lobby ambassador account. This account is not configured by default.

Key facts

CVSS score: 8.8 (v3.1)
Severity: HIGH
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-78
EPSS score: 0.9% (59th percentile)
In CISA KEV: No
In EU EUVD: Yes (EUVD-2025-13897)
Published: May 7, 2025
NVD last modified: June 17, 2026
Status: Analyzed

EU Vulnerability Database (EUVD)

This vulnerability is also tracked by ENISA as EUVD-2025-13897 in the EU Vulnerability Database. Last updated in EUVD on February 26, 2026.

View on the EU Vulnerability Database

Affected products

cisco / ios xe
cisco / ios xe
cisco / ios xe
cisco / ios xe
cisco / ios xe
cisco / ios xe
cisco / ios xe
cisco / ios xe
cisco / ios xe
cisco / ios xe
cisco / ios xe
cisco / ios xe
cisco / ios xe
cisco / ios xe
cisco / ios xe
cisco / ios xe
cisco / ios xe
cisco / ios xe
cisco / ios xe
cisco / ios xe
cisco / ios xe
cisco / ios xe
cisco / ios xe
cisco / ios xe
cisco / ios xe
cisco / ios xe
cisco / ios xe
cisco / ios xe
cisco / ios xe
cisco / ios xe
cisco / ios xe
cisco / ios xe
cisco / ios xe
cisco / ios xe
cisco / ios xe
cisco / ios xe
cisco / ios xe
cisco / ios xe
cisco / ios xe
cisco / ios xe
cisco / ios xe
cisco / ios xe
cisco / ios xe
cisco / ios xe
cisco / ios xe
cisco / ios xe
cisco / ios xe
cisco / ios xe
cisco / ios xe
cisco / ios xe

and 26 more…

Certified products that may be affected

5 FIPS 140 or Common Criteria certified products, from automated matching by sec-certs.org.

Cisco Embedded Services 9300 and 3300 Series Switches (ESS9300 & ESS3300) running IOS-XE 17.12 - Cisco Systems, Inc. - Common Criteria CCEVS-VR-VID-11521-2025 - active
Cisco cEdge Routers running IOS XE 17.12 with SD-WAN 20.12 - Cisco Systems, Inc. - Common Criteria 654-LSS - active
Cisco Catalyst Industrial Ethernet 3100 (IE3100) Rugged Series Switches running IOS-XE 17.12 - Cisco Systems, Inc. - Common Criteria CCEVS-VR-VID-11490-2024 - archived
Cisco Catalyst Industrial Ethernet 9300 Rugged Series Switches running IOS-XE 17.12 - Cisco Systems, Inc. - Common Criteria CCEVS-VR-VID-11466-2024 - archived
Cisco Catalyst Industrial Ethernet 3200, 3300, 3400, 3400H (IE3x00) Rugged Series Switches running IOS-XE 17.12 - Cisco Systems, Inc. - Common Criteria CCEVS-VR-VID-11443-2024 - archived

References

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webui-cmdinj-gVn3OKNC(Vendor Advisory)

Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS

Query CVEs from your AI assistant

The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.

Add the CVE brain