Cross-Site Scripting Vulnerability in Cisco Common Services Platform Collector

CVE-2025-20168

Summary

A vulnerability exists in the web-based management interface of the Cisco Common Services Platform Collector (CSPC) that enables authenticated, remote attackers to conduct cross-site scripting (XSS) attacks. This arises from insufficient validation of user-supplied input, permitting attackers to inject malicious code into specific pages. Exploiting this vulnerability allows attackers to execute arbitrary script code within the context of the interface or access sensitive information stored in the browser. To exploit this issue, attackers must possess at least a low-privileged account on the affected device. Currently, Cisco has not provided any software updates or workarounds to mitigate this vulnerability.

References