CVE-2025-20240

Name of the Vulnerable Software and Affected Versions Cisco IOS XE Software (affected versions not specified)

Description A flaw exists in the web UI of Cisco IOS XE Software that could allow a remote attacker to perform a reflected cross-site scripting (XSS) attack. This is caused by insufficient sanitization of user-provided input. An attacker could trick a user into clicking a malicious link, potentially leading to the execution of a reflected XSS attack and the theft of user cookies from the affected device.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.