Advisoriesby IbisCiscoCVE-2026-20198
Cisco Enterprise NFV Infrastructure Software: cross-site scripting
No fix yet
A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface.
This vulnerability is due to insufficient validation of user input. An attacker could exploit this vulnerability by persuading a user of an affected interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the browser of the targeted user or access sensitive, browser-based information.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| Cisco Enterprise NFV Infrastructure Software Product | <= 4.1.1 | No fix yet |
| <= 3.9.1 | No fix yet | |
| <= 3.5.2 | No fix yet | |
| <= 3.12.2 | No fix yet | |
| Cisco Unified Computing System (Standalone) Product | <= 4.0(2g) | No fix yet |
| <= 3.1(2i) | No fix yet | |
| <= 3.1(1d) | No fix yet | |
| <= 4.0(4i) | No fix yet | |
| Cisco Unified Computing System E-Series Software (UCSE) Product | <= 3.2.7 | No fix yet |
| <= 3.2.6 | No fix yet | |
| <= 3.2.4 | No fix yet | |
| <= 3.2.10 | No fix yet |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
- Severity from
- the vendor (its own CVE record or advisory)
- Weakness
- CWE-79