CVE-2025-20240

MEDIUM

Cisco IOS XE Software 16.6.1-16.6.10 - Unauthenticated Reflected Cross-Site Scripting

Title source: llm

Description

A vulnerability in the Web Authentication feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting attack (XSS) on an affected device. This vulnerability is due to improper sanitization of user-supplied input. An attacker could exploit this vulnerability by persuading a user to click a malicious link. A successful exploit could allow the attacker to execute a reflected XSS attack and steal user cookies from the affected device.

References (1)

Core 1

Core References

Various Sources

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webui-xss-VWyDgjOU

Scores

CVSS v3 6.1

EPSS 0.0004

EPSS Percentile 11.8%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-692

Status published

Products (50)

Cisco/Cisco IOS XE Software 16.10.1

Cisco/Cisco IOS XE Software 16.10.1a

Cisco/Cisco IOS XE Software 16.10.1b

Cisco/Cisco IOS XE Software 16.10.1c

Cisco/Cisco IOS XE Software 16.10.1d

Cisco/Cisco IOS XE Software 16.10.1e

Cisco/Cisco IOS XE Software 16.10.1f

Cisco/Cisco IOS XE Software 16.10.1g

Cisco/Cisco IOS XE Software 16.10.1s

Cisco/Cisco IOS XE Software 16.10.2

... and 40 more

Published Sep 24, 2025

Tracked Since Feb 18, 2026