Product:
Packaged Contact Center Enterprise
Summary
Multiple vulnerabilities in the web-based management interface of Cisco Packaged Contact Center Enterprise and Cisco Unified Contact Center Enterprise could allow an authenticated, remote attacker to conduct a cross-site scripting attack. These vulnerabilities exist because the web-based management interface does not properly validate user-supplied input. A successful exploit could allow the attacker to execute arbitrary script code or access sensitive, browser-based information.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 4.8 | CVE-2026-20109 |
Exploitation
To exploit these vulnerabilities, an attacker must have valid administrative credentials. The attacker can inject malicious code into specific pages of the web-based management interface. Once the code is executed, it can run in the context of the affected interface, potentially compromising sensitive information.
Affected Products
- Cisco Packaged Contact Center Enterprise: Vulnerable due to improper input validation in the web-based management interface.
- Cisco Unified Contact Center Enterprise: Also affected by the same vulnerabilities allowing for potential XSS attacks.
Mitigation
To mitigate these vulnerabilities, it is recommended that users ensure proper input validation is implemented in the web-based management interface. Additionally, restricting access to the management interface to trusted networks and regularly updating the software can help reduce the risk of exploitation.