CVE-2025-20123: cisco cisco crosswork network change automation Cross-site Scripting
Vulnerability summary
CVE-2025-20123 is a medium (CVSS 4.8) Cross-site Scripting vulnerability in cisco cisco crosswork network change automation. EPSS estimates a 0.27% chance of exploitation in the next 30 days, higher than 18.3% of scored vulnerabilities.
Timeline
- 08-01-2025PublishedVulnerability first disclosed.
- 08-01-2025Last modifiedVulnerability information updated.
Description
Multiple vulnerabilities in the web-based management interface of Cisco Crosswork Network Controller could allow an authenticated, remote attacker to conduct cross-site scripting (XSS) attacks against users of the interface of an affected system. These vulnerabilities exist because the web-based management interface does not properly validate user-supplied input. An attacker could exploit these vulnerabilities by inserting malicious data into specific data fields in the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. To exploit these vulnerabilities, the attacker must have valid administrative credentials. Cisco has released software updates that address these vulnerabilities. There are no workarounds that address these vulnerabilities.
CVSS metrics
2 scores · 2 sources · 1 version- NVDNIST4.8MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
EPSS trend
Probability
0.27%
Chance of exploitation in the next 30 days
Percentile
18%
Versus all other CVEs
30-day change
+0.01 pp
From 0.27% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Cisco2 products
- cisco crosswork network change automation3.0.0 | 3.0.1 | 1.0.0 | 2.0.0 | 2.0.1 | 3.0.2 | 2.0.2 | 3.0.3 | 4.0.0 | 4.1.0 | 4.5.0 | 4.1.1 | 5.0.0 | 4.5.1 | 4.1.2 | 5.0.1 | 4.5.2 | 5.0.2 | 4.1.3 | 6.0.0 | 4.1.4 | 6.0.2 | 5.0.3
- crosswork_network_controller≥ 5.0.0, < 5.0.4 | ≥ 6.0.0, < 6.0.3 | ≥ 7.0.0, < 7.0.1
1 vendor · 2 products