Reflected XSS Vulnerabilities in Cisco ISE Management Interface
CVE-2025-20303

5.4MEDIUM

Key Information:

Vendor

Cisco
Status
Cisco Identity Services Engine Software
Vendor
CVE Published:
5 November 2025

Badges

👾 Exploit Exists

What is CVE-2025-20303?

The web-based management interface of Cisco ISE and Cisco ISE-PIC contains multiple reflected XSS vulnerabilities due to insufficient validation of user-supplied input. An authenticated remote attacker with a low-level account can exploit these vulnerabilities by injecting malicious scripts into the interface's pages. This allows the attacker to execute arbitrary script code and potentially access sensitive information available in the browser context, posing a significant security risk.

Affected Version(s)

Cisco Identity Services Engine Software 3.1.0

Cisco Identity Services Engine Software 3.1.0 p1

Cisco Identity Services Engine Software 3.1.0 p3

References

https://sec.cloudapps.cisco.com/security/center/content/C...

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2025-20303 : Reflected XSS Vulnerabilities in Cisco ISE Management Interface