Cisco Enterprise Chat and Email Stored Cross-Site Scripting Vulnerability

🚨SEVERITY: MEDIUM — CVSS 6.1Security Advisory

TL;DR 📌

  • A vulnerability in the web UI of Cisco Enterprise Chat and Email (ECE) could allow an unauthenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface. This vulnerability exists because the web UI does not properly validate user-supplied input. An attacker could exploit this vulnerability by persuading a…
  • Highest CVSS: 6.1 (Medium).
  • Check the advisory for fixed releases — remediation detail is in the vendor link below.
  • CVEs: CVE-2025-20310.

What it is

CVE-2025-20310 is a stored cross-site scripting vulnerability in the web UI of Cisco Enterprise Chat and Email (ECE). It stems from insufficient validation of user-supplied input in the interface.

Exploitation requires an attacker to have valid agent credentials and to persuade a user of the interface to click a crafted link. Despite the network vector, this is not a fully unauthenticated attack path — the attacker needs agent-level access to ECE plus victim interaction. A successful attack lets the attacker execute arbitrary script in the context of the affected interface or access sensitive browser-based information belonging to the targeted user.

The flaw only affects ECE deployments where the inbound email security policy of the rich text content policy is disabled. This setting is found under Digital Channels > Chat and Email > Partition > Security > Rich Text Content Policy in the ECE System Console or the Cisco PCCE Single Pane of Glass. If that policy is enabled, the system is not affected.

Cisco rates this 6.1 (Medium) via CVSS vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. It is not listed in CISA’s KEV catalogue.

What to do

  • Check the rich text content policy setting on your ECE deployment: System Console or PCCE SPOG > Digital Channels > Chat and Email > Partition > Security > Rich Text Content Policy. If the inbound email security policy is disabled, the instance is exposed.
  • As a mitigation, enable the inbound email security policy setting on the rich text content policy. Cisco notes this has been tested successfully but advises validating it against your own environment before deploying, as it may affect functionality.
  • There are no workarounds beyond this mitigation — plan to move to fixed software.
  • For ECE Release 12, upgrade to 12.6(1)_ES11, which contains the fix.
  • For ECE Release 11, migrate to a fixed release; Cisco does not provide a direct fix for 11.x.
  • ECE Release 15 is not vulnerable.
  • Cisco PSIRT states it is not aware of any public announcements or malicious use of this vulnerability at this time.

For leadership 🧭

Executive summary. Cisco Enterprise Chat and Email deployments with the inbound email security policy disabled are exposed to a stored cross-site scripting flaw that can hijack an agent’s browser session via a crafted link, though it requires valid agent credentials to exploit. Check the configuration today and schedule the fix for Release 12 in your next change window.

Why it matters:

  • Exploitation needs valid ECE agent credentials plus a victim clicking a crafted link, so this is most relevant where agent accounts could be phished, shared, or compromised via other means.
  • A successful attack runs arbitrary script in the ECE web interface or accesses browser-based session data belonging to the targeted agent, which could expose customer chat or email content.
  • The exposure hinges entirely on one configuration toggle: the inbound email security policy under Rich Text Content Policy in the ECE System Console or PCCE SPOG.
  • Release 11 has no direct fix path and requires migration; only Release 12.6(1)_ES11 and Release 15 are confirmed safe.

Now / Next / Later:

  • Now: Check the Rich Text Content Policy setting (System Console or PCCE SPOG > Digital Channels > Chat and Email > Partition > Security) and enable the inbound email security policy if it’s currently disabled.
  • Next: In your next change window, upgrade Release 12 deployments to 12.6(1)_ES11; for Release 11, begin planning migration to a supported, fixed release since no direct patch exists.
  • Later: Validate the mitigation setting hasn’t degraded rich text or email handling functionality, and add the Rich Text Content Policy configuration to routine ECE hardening checks.

Source