Stored XSS Vulnerability in Cisco ISE Management Interface
CVE-2025-20331

5.4MEDIUM

Key Information:

Vendor

Cisco
Status
Cisco Identity Services Engine Software
Cisco Ise Passive Identity Connector
Vendor
CVE Published:
6 August 2025

Badges

👾 Exploit Exists

What is CVE-2025-20331?

A vulnerability exists in the web-based management interface of Cisco ISE and Cisco ISE-PIC, allowing authenticated remote attackers to perform stored XSS attacks. The flaw arises from inadequate validation of user-supplied input, enabling the injection of malicious scripts into specific interface pages. If successfully exploited, the attacker can run arbitrary scripts in the interface's context or access sensitive browser information. To trigger this vulnerability, at least a low-privileged account on the device is necessary.

Affected Version(s)

Cisco Identity Services Engine Software 3.1.0

Cisco Identity Services Engine Software 3.1.0 p1

Cisco Identity Services Engine Software 3.1.0 p3

References

https://sec.cloudapps.cisco.com/security/center/content/C...

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-20331 : Stored XSS Vulnerability in Cisco ISE Management Interface