Cross-Site Scripting Vulnerability in Cisco Identity Services Engine

CVE-2025-20267

What is CVE-2025-20267?

A flaw in the web-based management interface of Cisco Identity Services Engine (ISE) permits authenticated remote attackers to launch cross-site scripting (XSS) attacks. This vulnerability stems from inadequate validation of user-supplied inputs, enabling an attacker to inject harmful scripts into certain pages of the interface. If successful, the malicious code can execute in the context of the affected interface, jeopardizing sensitive browser information. Successful exploitation requires the attacker to possess valid administrative credentials.

References