Reflected XSS Vulnerability in Cisco ISE and Cisco ISE-PIC Management Interfaces

CVE-2025-20289

What is CVE-2025-20289?

The web-based management interface of Cisco ISE and Cisco ISE-PIC is vulnerable to reflected Cross-Site Scripting (XSS) attacks. Insufficient validation of user input can be exploited by authenticated remote attackers who could inject malicious scripts into specific pages. This could allow execution of arbitrary script code within the context of the user’s session or expose sensitive browser-based information. To successfully carry out this attack, the perpetrator needs to possess a low-privileged account on the system.

References