Cisco IOS XE Software Web UI Reflected Cross-Site Scripting Vulnerability

🚨SEVERITY: MEDIUM — CVSS 6.1Security Advisory

TL;DR 📌

  • A vulnerability in the Web Authentication feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting attack (XSS) on an affected device. This vulnerability is due to improper sanitization of user-supplied input. An attacker could exploit this vulnerability by persuading a user to click a malicious link.…
  • Highest CVSS: 6.1 (Medium).
  • Check the advisory for fixed releases — remediation detail is in the vendor link below.
  • CVEs: CVE-2025-20240.

What it is

CVE-2025-20240 is a reflected cross-site scripting flaw in the Web Authentication feature of Cisco IOS XE Software. It sits in the device’s HTTP/HTTPS web server component, not the CLI or a background service, and it’s triggered specifically when Web Authentication is configured on top of an enabled HTTP or HTTPS server.

The root cause is improper sanitisation of user-supplied input in the web authentication path. Exploitation requires an unauthenticated remote attacker to persuade a user to click a crafted link (CVSS vector confirms UI:R — user interaction required, AV:N — network, PR:N — no privileges needed on the attacker’s part). There’s no need for the attacker to hold credentials on the device itself.

A successful attack lets the attacker run script in the context of the affected device’s web interface and steal user cookies. This is a client-side attack against whoever clicks the link, not a route to device compromise or configuration changes — CVSS impact is limited to confidentiality and integrity (C:L/I:L), with no availability impact.

Exposure depends on configuration: the device is only reachable via this vector if ip http server or ip http secure-server is present in the running config, and Web Authentication is enabled (via proxy http in legacy switch mode, or a parameter-map type webauth entry on cEdge or wireless platforms). Cisco IOS, IOS XR and NX-OS are confirmed not affected — this is IOS XE only.

What to do

  • Check exposure directly: run show running-config | include ip http server|secure|active to confirm whether HTTP/HTTPS is enabled, then check for Web Authentication config — show running-config | include proxy http (legacy switch mode) or show running-config | section parameter-map / show running-config | include parameter-map (cEdge and wireless) for a parameter-map type webauth entry.
  • Use the Cisco Software Checker with your current release to identify the first fixed release for this advisory; no specific fixed version numbers are given here, so run the checker rather than guessing.
  • There is no workaround. If you can’t patch immediately, disabling the HTTP server (no ip http server / no ip http secure-server, both if both are configured) removes the attack surface, but be aware this also disables the web management interface and can break client logins that depend on Web Authentication — test before deploying in production.
  • Proof-of-concept exploit code is publicly available for this vulnerability, so treat patching as a priority even though Cisco PSIRT has not reported malicious use.
  • Warn users with access to the device’s web interface not to click unsolicited links purporting to be device management URLs, as this is a user-interaction-dependent attack.

For leadership 🧭

Executive summary. Devices running IOS XE with the HTTP/HTTPS server and Web Authentication enabled can be used to run script against a user who clicks a malicious link, exposing that user’s cookies rather than the device itself. Proof-of-concept code is public, so this should be checked and patched in the next routine change window rather than left for the semiannual cycle.

Why it matters:

  • Affects IOS XE devices only where both the HTTP/HTTPS server and Web Authentication (via proxy http, or parameter-map type webauth on cEdge/wireless) are configured together — IOS, IOS XR and NX-OS are unaffected.
  • No attacker credentials or device access are needed; the attack relies purely on a user with web-interface access clicking a crafted link (AV:N, PR:N, UI:R).
  • Impact is limited to stealing session cookies from the device’s web interface (C:L/I:L) — it does not directly allow configuration changes or device takeover.
  • Proof-of-concept exploit code is publicly available, increasing the chance of opportunistic use even though Cisco has not observed malicious activity.

Now / Next / Later:

  • Now: Run show running-config | include ip http server|secure|active and then check for proxy http or parameter-map type webauth to identify which devices actually have both HTTP(S) and Web Authentication enabled and are therefore exposed.
  • Next: Use the Cisco Software Checker against each exposed device’s current release to find the first fixed IOS XE version and schedule the upgrade; there is no vendor workaround beyond disabling the HTTP server, which itself breaks web management and Web Authentication logins.
  • Later: Where Web Authentication or the web management interface isn’t operationally required, disable the HTTP/HTTPS server permanently and build exposure checks for ip http server/secure-server and parameter-map type webauth into routine IOS XE configuration audits.

Source