An authenticated remote attacker can send a crafted HTTP request to the Lobby Ambassador web‑based management API of Cisco IOS XE Software. The vulnerability lies in insufficient validation of parameters received by an API endpoint, a weakness categorized as CWE‑1286. A successful exploit allows the creation of a new user with privilege level 1, providing the attacker with access to management APIs that should normally be restricted, potentially enabling configuration changes and other privileged actions.

Cisco IOS XE Software devices that expose the Lobby Ambassador web‑based management API are affected. No specific version information is supplied, so all installations of this component should be considered potentially vulnerable until a vendor update is applied.

The CVSS base score of 5.4 indicates medium severity. With no EPSS score available and the issue not listed in the CISA KEV catalog, the risk of exploitation remains moderate and unproven. The attack vector is likely network‑based, requiring the attacker to authenticate as a Lobby Ambassador user and target the exposed API over HTTP to create privileged credentials.