EUVD-2026-17945
GHSA-37g6-52v8-pjqr
Severity by source
AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with administrative privileges to conduct a stored XSS attack against a user of the interface.
This vulnerability is due to insufficient validation of user input. An attacker could exploit this vulnerability by persuading a user of an affected interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the browser of the targeted user or access sensitive, browser-based information.
AnalysisAI
Stored XSS in Cisco IMC web management interface allows authenticated administrators to inject arbitrary script code executed in users' browsers via insufficient input validation. Affects Cisco Enterprise NFV Infrastructure Software, Cisco Unified Computing System (Standalone), and Cisco UCS E-Series Software. Requires administrative privileges and user interaction (clicking a crafted link), resulting in session hijacking, credential theft, or unauthorized access to sensitive browser-based information. No public exploit code identified at time of analysis.
Technical ContextAI
This is a stored cross-site scripting (XSS) vulnerability (CWE-79) in the web-based management interface of Cisco IMC (Integrated Management Controller). The vulnerability stems from insufficient validation and sanitization of user input before storage in the application's database. When an authenticated administrator submits malicious script payloads through the management interface, the application fails to properly encode or filter the input. Subsequent requests to view the affected data cause the stored malicious script to be rendered and executed in the context of victims' browsers. The vulnerability affects multiple Cisco products that rely on IMC for management: Enterprise NFV Infrastructure Software, Unified Computing System (Standalone), and UCS E-Series Software. The CVSS vector indicates this is a network-accessible vulnerability with low attack complexity, but requires high-privilege authentication (administrative account) and user interaction (social engineering to click a link). The impact is limited to confidentiality and integrity (disclosure and modification of browser-accessible data), with no availability impact.
RemediationAI
Consult the Cisco security advisory at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cimc-xss-A2tkgVAB for specific patched versions applicable to your Cisco product (Enterprise NFV Infrastructure Software, Unified Computing System Standalone, or UCS E-Series Software). Apply the vendor-released patch immediately to the IMC management interface firmware. Until patches can be deployed, implement administrative access controls to limit IMC console access to trusted users, enforce strong authentication for administrative accounts, restrict network access to the IMC management interface using firewall rules or VLANs, and conduct security awareness training with administrative users to recognize and avoid clicking suspicious links within the management interface. Monitor IMC logs for suspicious configuration changes or script injection attempts.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today