CVE-2025-20179: Cisco Expressway Series Cross-Site Scripting Vulnerability
A vulnerability in the web-based management interface of Cisco Expressway Series could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. This vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. Note: Cisco Expressway Series refers to Cisco Expressway Control (Expressway-C) devices and Cisco Expressway Edge (Expressway-E) devices.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-20179?
CVE-2025-20179 is rated as a critical vulnerability due to its potential for unauthenticated remote attacks via cross-site scripting.
How do I fix CVE-2025-20179?
To fix CVE-2025-20179, apply the latest security patch released by Cisco for the Expressway Series.
Who is affected by CVE-2025-20179?
CVE-2025-20179 affects users of the web-based management interface of the Cisco Expressway Series.
What type of attack does CVE-2025-20179 facilitate?
CVE-2025-20179 facilitates cross-site scripting (XSS) attacks against users accessing the management interface.
Is authentication required to exploit CVE-2025-20179?
No, CVE-2025-20179 can be exploited by unauthenticated remote attackers.