Product:
Cisco Cyber Vision Center
Summary
A vulnerability in the web-based management interface of Cisco Cyber Vision Center could allow an authenticated, remote attacker to conduct cross-site scripting attacks against a user of the interface. This vulnerability is due to insufficient validation of user-supplied input by the web-based management interface. An attacker could exploit this vulnerability by injecting malicious code into specific pages of the interface.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 5.4 | CVE-2025-20357 |
Exploitation
To exploit this vulnerability, the attacker must have valid administrative credentials that allow access to the Reports page. By default, all pre-defined users have this access, as do any custom users that are configured to allow access to the Reports page. Once the attacker has access, they can inject malicious code into the interface, which could lead to the execution of arbitrary script code or access to sensitive browser-based information.
Affected Products
- Cisco Cyber Vision Center: Vulnerable due to insufficient validation of user input in the web-based management interface.
Mitigation
To mitigate this vulnerability, it is recommended to restrict access to the Reports page to only trusted users and to ensure that all user input is properly validated. Regularly updating the system and applying security patches can also help protect against potential exploits.