Stored Cross-Site Scripting Vulnerability in Cisco Catalyst SD-WAN Manager

CVE-2025-20147

What is CVE-2025-20147?

A stored cross-site scripting vulnerability has been identified in the web-based management interface of Cisco Catalyst SD-WAN Manager, allowing authenticated, remote attackers to inject malicious scripts through improper sanitization of user input. Exploitation of this vulnerability can lead to unauthorized actions on behalf of users and compromise confidentiality. The risk arises when an affected system processes malicious content, which could be stored and executed within the context of a user's session, potentially impacting user security and data integrity.

References