Product:
Cisco IOS XE Software
Summary
A vulnerability in the web UI of Cisco IOS XE Software could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting attack on an affected device. This vulnerability is due to improper sanitization of user-supplied input. An attacker could exploit this vulnerability by persuading a user to click a malicious link.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 6.1 | CVE-2025-20240 |
Exploitation
To exploit this vulnerability, an attacker must convince a user to click on a specially crafted link that contains malicious input. Once the user interacts with the link, the attacker can execute a reflected XSS attack, potentially allowing them to steal user cookies and gain unauthorized access to sensitive information on the affected device.
Affected Products
- Cisco IOS XE Software: Vulnerable due to improper input sanitization in the web UI, allowing for reflected XSS attacks.
Mitigation
To mitigate this vulnerability, users should avoid clicking on untrusted links and ensure that their devices are updated with the latest security patches from Cisco. Implementing web application firewalls and other security measures can also help reduce the risk of exploitation.