Reflected XSS Vulnerability in Cisco ISE Web Management Interface

CVE-2025-20304

What is CVE-2025-20304?

Multiple vulnerabilities have been identified in the web-based management interface of Cisco ISE and Cisco ISE-PIC. These vulnerabilities arise from a lack of proper validation of user-supplied input, allowing an authenticated remote attacker to initiate a reflected XSS attack on users interacting with the interface. By injecting malicious code into specific web pages, the attacker can execute arbitrary scripts within the context of the affected interface or gain access to sensitive data stored in the user's browser. Exploitation necessitates that the attacker possesses at least a low-privileged account on the impacted device.

References