Cisco BroadWorks Application Delivery Platform Cross-Site Scripting Vulnerability

TL;DR 📌

• A vulnerability in the web-based management interface of Cisco BroadWorks CommPilot Application Software could allow an authenticated, remote attacker to conduct cross-site scripting (XSS) attacks against a user of the interface. This vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected system. An attacker could exploit this…
• Highest CVSS: 4.8 (Medium).
• Fix available — see the first fixed release below.
• CVEs: CVE-2025-20307.

What it is

CVE-2025-20307 is a stored cross-site scripting flaw in the web-based management interface of Cisco BroadWorks CommPilot Application Software. It affects the CommPilot interface whether it’s run as a standalone package or bundled with the BroadWorks Application Server or BroadWorks Xtended Services Platform.

The problem is insufficient validation of user-supplied input on specific pages of the interface. An attacker with valid administrative credentials can inject malicious script into those pages. When another user of the interface later views the affected page, the injected script executes in their browser session, in the context of the CommPilot interface.

Exploitation requires network access and authentication — this is not an unauthenticated flaw. Per the CVSS vector (AV:N/AC:L/PR:H/UI:R/S:C), the attacker needs high privileges (administrative credentials) and the victim must interact with the malicious content. Impact is limited to confidentiality and integrity within the browser session (C:L/I:L), with no availability impact. Cisco rates this 4.8 (Medium).

What to do

• Upgrade Cisco BroadWorks CommPilot Application Software to a fixed release:
  • 24.0 → 24.0.2025.05
  • 26.0 → 26.0.2025.05
• If running 23.0 or 25.0, note that Cisco has not issued a fix for those trains — migrate to a fixed release (24.0.2025.05 or 26.0.2025.05).
• If CommPilot is bundled with BroadWorks Application Server, upgrade any release earlier than RI.2025.05 to RI.2025.05.
• If bundled with BroadWorks Xtended Services Platform, upgrade any release earlier than RI.2025.08 to RI.2025.08.
• There are no workarounds; patching is the only remediation path.
• Review who holds administrative credentials on the CommPilot interface — exploitation depends on an attacker already having admin-level access, so tightening credential management and admin account hygiene reduces the practical attack surface while patches are rolled out.

Fixed releases

For leadership 🧭

Executive summary. A stored cross-site scripting flaw in Cisco BroadWorks CommPilot lets an authenticated administrator plant script that executes in another admin’s browser session, exposing session data within CommPilot. It’s rated Medium severity and requires existing admin credentials, so it can wait for a scheduled patch window rather than emergency action.

Why it matters:

• Exploitation requires the attacker to already hold valid administrative credentials on the CommPilot interface, so the risk is concentrated among service-provider admin accounts rather than external unauthenticated users
• Affected script runs in the context of the CommPilot management interface, meaning a compromised or malicious admin account could read or manipulate what another admin’s browser session sees on that page
• No workaround exists — the interface remains exposed until the software is upgraded, whether CommPilot is run standalone or bundled with BroadWorks Application Server or Xtended Services Platform
• Systems on the 23.0 or 25.0 release trains have no dedicated fix and must migrate to 24.0.2025.05 or 26.0.2025.05 to remediate

Now / Next / Later:

• Now: Identify every CommPilot deployment — standalone, or bundled with BroadWorks Application Server or Xtended Services Platform — and check its release against the fixed versions.
• Next: Upgrade CommPilot to 24.0.2025.05 or 26.0.2025.05 (migrating 23.0/25.0 trains to one of these), and update bundled Application Server instances to RI.2025.05 or Xtended Services Platform instances to RI.2025.08.
• Later: Tighten administrative account hygiene on the CommPilot interface — reduce the number of standing admin credentials and review who holds them, since exploitation depends entirely on an attacker already possessing valid admin access.

Source

• Cisco advisory
• CVE-2025-20307 on NVD