Stored Cross-Site Scripting Vulnerability in Cisco Small Business Switches

CVE-2023-20188

Summary

A security flaw exists in the web-based management interface of several Cisco Small Business Switches, enabling authenticated attackers to execute stored cross-site scripting (XSS) attacks. This vulnerability arises from inadequate validation of input provided by users. By deceiving a victim into accessing a malicious page, an attacker can potentially run arbitrary scripts within the context of the management interface, which may lead to unauthorized data access and manipulation. Effective exploitation requires valid credentials to access the management interface, as Cisco has not issued any updates to rectify this issue.

References