CVE-2025-20240

State: Published
Severity: 6.1 Medium
Published: Sep 24, 2025
Updated: Sep 26, 2025
Reserved: Oct 10, 2024

Description

A vulnerability in the Web Authentication feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting attack (XSS) on an affected device. This vulnerability is due to improper sanitization of user-supplied input. An attacker could exploit this vulnerability by persuading a user to click a malicious link. A successful exploit could allow the attacker to execute a reflected XSS attack and steal user cookies from the affected device.

Scores

CVSS	Score	Vector	Source
3.1	6.1 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	cisco

Weaknesses

CWE-692 Incomplete Blacklist to Cross-Site Scripting

Affected Products

Product	Versions
Cisco IOS XE SoftwareCisco	16.6.1Affected 16.6.2Affected 16.6.3Affected 16.6.4Affected 16.6.5Affected 16.6.4aAffected 16.6.5aAffected 16.6.6Affected 16.6.7Affected 16.6.8Affected 16.6.9Affected 16.6.10Affected 16.7.1Affected 16.7.1aAffected 16.7.1bAffected 16.7.2Affected 16.7.3Affected 16.7.4Affected 16.8.1Affected 16.8.1aAffected 16.8.1bAffected 16.8.1sAffected 16.8.1cAffected 16.8.1dAffected 16.8.2Affected and 191 more versions

Product

Versions

Cisco IOS XE SoftwareCisco

16.6.1Affected
16.6.2Affected
16.6.3Affected
16.6.4Affected
16.6.5Affected
16.6.4aAffected
16.6.5aAffected
16.6.6Affected
16.6.7Affected
16.6.8Affected
16.6.9Affected
16.6.10Affected
16.7.1Affected
16.7.1aAffected
16.7.1bAffected
16.7.2Affected
16.7.3Affected
16.7.4Affected
16.8.1Affected
16.8.1aAffected
16.8.1bAffected
16.8.1sAffected
16.8.1cAffected
16.8.1dAffected
16.8.2Affected
and 191 more versions

References

cisco-sa-webui-xss-VWyDgjOU

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.