CVE-2025-20240: XSS
A vulnerability in the Web Authentication feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting attack (XSS) on an affected device. This vulnerability is due to improper sanitization of user-supplied input. An attacker could exploit this vulnerability by persuading a user to click a malicious link. A successful exploit could allow the attacker to execute a reflected XSS attack and steal user cookies from the affected device.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-20240?
CVE-2025-20240 is considered to have a high severity due to its potential for unauthorized remote access and exploitation.
How do I fix CVE-2025-20240?
To fix CVE-2025-20240, it is recommended to update the Cisco IOS XE Software to the latest version that includes patches for this vulnerability.
What types of attacks can be conducted using CVE-2025-20240?
CVE-2025-20240 allows for reflected cross-site scripting (XSS) attacks, which can compromise session integrity and potentially lead to data theft.
Who is affected by CVE-2025-20240?
Organizations using vulnerable versions of Cisco IOS XE Software are at risk from CVE-2025-20240.
Is CVE-2025-20240 exploit publicly available?
As of now, there are reports that CVE-2025-20240 is being actively exploited in the wild.