XSS Vulnerability in Cisco UCS Manager Software Web Interface
CVE-2025-20296

5.4MEDIUM

Key Information:

Vendor

Cisco
Status
Cisco Unified Computing System (managed)
Vendor
CVE Published:
27 August 2025

Badges

👾 Exploit Exists

What is CVE-2025-20296?

A vulnerability exists in the web-based management interface of Cisco UCS Manager Software due to inadequate validation of user inputs. This flaw allows an authenticated remote attacker, who must have specific administrative roles, to perform a stored cross-site scripting (XSS) attack. By injecting malicious scripts into designated pages within the interface, an attacker can execute arbitrary code in the user's browser context. This can potentially lead to unauthorized access to sensitive browser-based information, compromising the security of the system.

Affected Version(s)

Cisco Unified Computing System (Managed) 4.0(1a)

Cisco Unified Computing System (Managed) 4.1(1d)

Cisco Unified Computing System (Managed) 4.0(4f)

References

https://sec.cloudapps.cisco.com/security/center/content/C...

CVSS V3.0

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-20296 : XSS Vulnerability in Cisco UCS Manager Software Web Interface