CVE-2025-20240: cisco cisco ios xe software

Vulnerability summary

CVE-2025-20240 is a medium (CVSS 6.1) vulnerability in cisco cisco ios xe software. EPSS estimates a 0.29% chance of exploitation in the next 30 days, higher than 20.3% of scored vulnerabilities.

Timeline

1. 24-09-2025
   PublishedVulnerability first disclosed.
2. 26-09-2025
   Last modifiedVulnerability information updated.

Description

A vulnerability in the Web Authentication feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting attack (XSS) on an affected device. This vulnerability is due to improper sanitization of user-supplied input. An attacker could exploit this vulnerability by persuading a user to click a malicious link. A successful exploit could allow the attacker to execute a reflected XSS attack and steal user cookies from the affected device.

• CWE-692Incomplete Denylist to Cross-Site ScriptingThe product uses a denylist-based protection mechanism to defend against XSS attacks, but the denylist is incomplete, allowing XSS variants to succeed.