Reflected XSS Vulnerabilities in Cisco ISE Management Interface

CVE-2025-20303

What is CVE-2025-20303?

The web-based management interface of Cisco ISE and Cisco ISE-PIC contains multiple reflected XSS vulnerabilities due to insufficient validation of user-supplied input. An authenticated remote attacker with a low-level account can exploit these vulnerabilities by injecting malicious scripts into the interface's pages. This allows the attacker to execute arbitrary script code and potentially access sensitive information available in the browser context, posing a significant security risk.

References