Cisco Integrated Management Controller Virtual Keyboard Video Monitor Stored Cross-Site Scripting Vulnerability

🚨SEVERITY: MEDIUM — CVSS 5.4Security Advisory

TL;DR 📌

  • A vulnerability in the Virtual Keyboard Video Monitor (vKVM) connection handling of Cisco Integrated Management Controller (IMC) could allow an authenticated, remote attacker with low privileges to conduct a stored cross-site scripting (XSS) attack against a user of the interface. This vulnerability is due to insufficient validation of user-supplied input by the web-based management interface…
  • Highest CVSS: 5.4 (Medium).
  • Check the advisory for fixed releases — remediation detail is in the vendor link below.
  • CVEs: CVE-2025-20342.

What it is

CVE-2025-20342 is a stored cross-site scripting vulnerability in the Virtual Keyboard Video Monitor (vKVM) connection handling of Cisco Integrated Management Controller (IMC). The web-based management interface fails to properly validate user-supplied input in a specific data field, allowing injected script to persist and execute in the context of that interface.

Exploitation requires an authenticated, remote attacker who already holds valid credentials with privileges sufficient for vKVM access on the affected device. There is no unauthenticated path. Once exploited, the attacker can run arbitrary script in the vKVM interface or access sensitive browser-based information belonging to another user of that interface — this is a management-plane issue, not a data-plane one.

The affected vKVM client is shared code, so the flaw reaches well beyond standalone Cisco IMC. It’s present in Cisco UCS Manager Software, UCS B-Series, C-Series (M6, M7, M8), E-Series (M6), X-Series, and Catalyst 8300 Series Edge uCPE. It also extends into any Cisco appliance built on a preconfigured UCS C-Series server that exposes the Cisco IMC UI — the advisory lists a long set of these, including APIC Servers, Catalyst Center Appliances, Nexus Dashboard Appliances, Secure Firewall Management Center Appliances, Secure Network Analytics Appliances, and others.

Cisco confirms UCS C-Series M5, UCS E-Series M3, UCS S-Series Storage Servers, and 5000 Series ENCS are not affected. There are no workarounds.

What to do

  • Identify every UCS/IMC-based platform in your estate, including preconfigured appliances (APIC, Catalyst Center, Nexus Dashboard, Secure Firewall Management Center, Secure Network Analytics, and the other appliance families listed in the advisory) — the shared vKVM client means exposure isn’t limited to standalone UCS hardware.
  • Restrict who holds vKVM-capable credentials on IMC and UCS Manager; this bug requires low-privilege authenticated access, so credential hygiene and least-privilege role assignment reduce the practical attack surface even before patching.
  • Patch according to platform:
    • Catalyst 8300 Series Edge uCPE (NFVIS): upgrade to 4.18.1 (via NFVIS firmware auto-upgrade).
    • UCS Manager Software: 4.1 and earlier must migrate to a fixed release; 4.2 line fix is 4.2(3p); 4.3 line fix is 4.3(6a); 6.0 is not vulnerable.
    • UCS B-Series, X-Series, and the various appliance families (Telemetry Broker, IEC6400, Secure Endpoint Private Cloud, Secure Firewall Management Center, Secure Malware Analytics, Secure Network Analytics, Secure Network Server) each have their own fixed firmware build and upgrade mechanism (HUU image, hotfix, ISO, or patch file) as listed in the advisory’s Fixed Software table — check the specific product line for the exact version and applicable procedure.
  • Since there is no workaround, treat patching as the only mitigation; do not rely on interim configuration changes.
  • No exploitation in the wild has been reported by Cisco PSIRT for this issue at time of publication, so this can be scheduled through normal patch cycles rather than as an emergency, but should not be deprioritised indefinitely given the breadth of affected appliances.

For leadership 🧭

Executive summary. This is a management-plane flaw affecting Cisco’s out-of-band server management (IMC/UCS Manager) and dozens of appliances built on the same UCS hardware, from Nexus Dashboard to Secure Firewall Management Center. It requires an attacker to already hold valid low-privilege credentials, there’s no exploitation reported, and no workaround, so it should go through a normal patch cycle rather than an emergency one, but shouldn’t be shelved given how widely the affected client is embedded.

Why it matters:

  • The vulnerable vKVM client is shared code, so exposure isn’t limited to standalone UCS servers — it reaches appliances like APIC, Catalyst Center, Nexus Dashboard, Secure Firewall Management Center and Secure Network Analytics if they expose the Cisco IMC UI.
  • A successful attack lets one authenticated vKVM user run script in another user’s session or pull sensitive browser-based data, which matters because vKVM sessions often belong to administrators managing hardware remotely.
  • There is no workaround, so any device running an affected release stays exposed until the specific firmware or hotfix for that product line is applied.
  • Fix paths differ by platform — NFVIS auto-upgrade, UCS Manager release migration, HUU images, hotfixes or ISO updates — so a single patch action won’t cover the whole estate.

Now / Next / Later:

  • Now: Inventory every UCS/IMC-based platform and preconfigured appliance in the estate (including the appliance families listed in the advisory) that exposes the Cisco IMC UI, and check who currently holds vKVM-capable credentials on each.
  • Next: Apply the fixed release appropriate to each platform in the next change window — NFVIS 4.18.1 for Catalyst 8300 uCPE, 4.2(3p)/4.3(6a) for UCS Manager (or migrate off 4.1 and earlier), and the corresponding HUU/hotfix/ISO/patch for B-Series, X-Series and the affected appliance families.
  • Later: Tighten role assignment so vKVM access is granted only to users who need it, since this bug and similar management-interface flaws rely on an attacker already holding low-privilege authenticated access.

Source