Cisco IOS XE Software Web Authentication Reflected Cross-Site Scripting Vulnerability

🚨SEVERITY: MEDIUM — CVSS 6.1Security Advisory

TL;DR 📌

  • A vulnerability in the Web Authentication feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting attack (XSS) on an affected device. This vulnerability is due to improper sanitization of user-supplied input. An attacker could exploit this vulnerability by persuading a user to click a malicious link.…
  • Highest CVSS: 6.1 (Medium).
  • Check the advisory for fixed releases — remediation detail is in the vendor link below.
  • CVEs: CVE-2025-20240.

What it is

CVE-2025-20240 is a reflected cross-site scripting (XSS) flaw in the Web Authentication feature of Cisco IOS XE Software. It’s caused by improper sanitisation of user-supplied input in the web authentication interface.

Exploitation requires HTTP or HTTPS to be enabled on the device (via ip http server or ip http secure-server) alongside the Web Authentication feature itself. On switches this shows up as proxy http under ip admission; on cEdge devices and wireless controllers it appears as parameter-map type webauth in the running configuration. If neither the HTTP/HTTPS server nor Web Authentication is configured, the device isn’t exposed.

The attack is unauthenticated and remote, but requires user interaction: an attacker crafts a malicious link and persuades a user to click it. There’s no direct device compromise — the payload executes in the victim’s browser session against the device’s web interface, and a successful attack lets the attacker steal user cookies from the affected device. CVSS is 6.1 (medium), reflecting the need for user interaction and the limited impact (confidentiality and integrity are rated low, no impact on availability).

Cisco has confirmed this does not affect IOS Software, IOS XR Software, or NX-OS Software — it’s specific to IOS XE. Cisco PSIRT notes that proof-of-concept exploit code is available, but has not seen malicious use.

What to do

  • Check exposure first: run show running-config | include ip http server|secure|active to confirm whether HTTP/HTTPS server is enabled, then check for Web Authentication configuration — show running-config | include proxy http (legacy switch mode), show running-config | section parameter-map (cEdge), or show running-config | include parameter-map (wireless controllers).
  • If ip http server is present but paired with ip http active-session-modules none, the flaw isn’t exploitable over HTTP; the equivalent applies to HTTPS with ip http secure-active-session-modules none. Check for these mitigating lines before assuming exposure.
  • There are no workarounds specific to this vulnerability. Disabling the HTTP/HTTPS server (no ip http server / no ip http secure-server) removes the attack path but will also break the web management interface and any client logins that depend on Web Authentication — weigh this against operational impact.
  • Use the Cisco Software Checker against your running release to get the specific fixed version for your train, since fixed releases aren’t listed as a flat table in this advisory. Plan an upgrade rather than relying on the HTTP-disable workaround long term.
  • This advisory is bundled with the September 2025 semiannual IOS/IOS XE publication — worth checking the linked bundle for other advisories affecting the same devices while you’re doing the upgrade planning.

For leadership 🧭

Executive summary. Cisco IOS XE devices with the web management interface and Web Authentication feature turned on can be tricked into running attacker-supplied script in a user’s browser, exposing session cookies for that device. There is no known exploitation in the wild and no direct device compromise, so this can be scheduled into a normal patch cycle rather than treated as an emergency.

Why it matters:

  • Affects Cisco IOS XE switches, cEdge routers and wireless controllers specifically when ip http server/ip http secure-server and Web Authentication (proxy http or parameter-map type webauth) are both configured — devices without this combination are not exposed.
  • A successful attack steals user cookies from the affected device’s web interface, which could let an attacker hijack an authenticated session rather than gain direct control of the device.
  • Proof-of-concept exploit code is already public, increasing the chance someone builds a working attack even though Cisco has not seen it used maliciously.
  • There is no workaround aside from disabling the HTTP/HTTPS server entirely, which also breaks the web management interface and any client logins relying on Web Authentication.

Now / Next / Later:

  • Now: Run show running-config | include ip http server|secure|active alongside the relevant Web Authentication check (proxy http, parameter-map type webauth, depending on platform) to identify which devices are actually exposed.
  • Next: For exposed devices without the mitigating active-session-modules none lines, use the Cisco Software Checker against each running release to find the fixed version and schedule the upgrade during a maintenance window.
  • Later: Standardise a check for HTTP/HTTPS server and Web Authentication exposure into routine configuration audits so newly deployed IOS XE devices aren’t left with an avoidable attack surface, and track this fix alongside the other advisories in the September 2025 IOS/IOS XE bundle.

Source