EUVD-2026-17945
GHSA-37g6-52v8-pjqr
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | This vulnerability presents moderate real-world risk despite its moderate CVSS score of 4.8. The attack requires two significant barriers: first, an attacker must possess valid administrative credentials to the IMC interface; second, the attacker must successfully socially engineer a victim user to click a malicious link. However, the stored XSS nature means that once injected, the payload persists and executes for any user accessing the affected interface data, multiplying exposure. The network-accessible attack vector and low attack complexity are favorable to attackers within administrative reach. The CVSS scope change (C) indicates cross-boundary impact, suggesting potential privilege escalation or lateral movement within enterprise environments. The absence of public exploit code and KEV listing indicates this is not yet actively exploited, reducing immediate risk. Organizations with strict administrative access controls, multi-factor authentication on IMC accounts, and user security awareness training will see significantly reduced exploitability. Priority should align with administrative credential security posture and the prevalence of IMC deployments in the environment. |
| Exploit ScenarioDerived | An attacker with valid administrative credentials to a Cisco IMC interface crafts a malicious link containing JavaScript payload and embeds it in a configuration parameter or system message visible to other administrative users. When an administrator clicks the link or views the affected configuration section, the stored script executes in their browser with the privileges of their authenticated session, allowing the attacker to steal session cookies, capture credentials entered into the interface, modify system configurations, or redirect the administrator to a phishing page. The attack requires both initial administrative access and successful social engineering of a target user to click the malicious link. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 01, 2026
Stored XSS in Cisco IMC web management interface allows authenticated administrators to inject arbitrary script code executed in users' browsers via insufficient input validation. Affects Cisco Enterprise NFV Infrastructure Software, Cisco Unified Computing System (Standalone), and Cisco UCS E-Series Software. Requires administrative privileges and user interaction (clicking a crafted link), resulting in session hijacking, credential theft, or unauthorized access to sensitive browser-based information. No public exploit code identified at time of analysis.
RemediationAI
Consult the Cisco security advisory at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cimc-xss-A2tkgVAB for specific patched versions applicable to your Cisco product (Enterprise NFV Infrastructure Software, Unified Computing System Standalone, or UCS E-Series Software). Apply the vendor-released patch immediately to the IMC management interface firmware. Until patches can be deployed, implement administrative access controls to limit IMC console access to trusted users, enforce strong authentication for administrative accounts, restrict network access to the IMC management interface using firewall rules or VLANs, and conduct security awareness training with administrative users to recognize and avoid clicking suspicious links within the management interface. Monitor IMC logs for suspicious configuration changes or script injection attempts.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This is a stored cross-site scripting (XSS) vulnerability (CWE-79) in the web-based management interface of Cisco IMC (Integrated Management Controller). The vulnerability stems from insufficient validation and sanitization of user input before storage in the application's database. When an authenticated administrator submits malicious script payloads through the management interface, the application fails to properly encode or filter the input. Subsequent requests to view the affected data cause the stored malicious script to be rendered and executed in the context of victims' browsers. The vulnerability affects multiple Cisco products that rely on IMC for management: Enterprise NFV Infrastructure Software, Unified Computing System (Standalone), and UCS E-Series Software. The CVSS vector indicates this is a network-accessible vulnerability with low attack complexity, but requires high-privilege authentication (administrative account) and user interaction (social engineering to click a link). The impact is limited to confidentiality and integrity (disclosure and modification of browser-accessible data), with no availability impact.
Know when Cisco Enterprise Nfv Infrastructure Software gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Primary rating from Vendor (cisco) · only source for this CVE.
CVSS VectorVendor: cisco
DescriptionCVE.org
A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with administrative privileges to conduct a stored XSS attack against a user of the interface.
This vulnerability is due to insufficient validation of user input. An attacker could exploit this vulnerability by persuading a user of an affected interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the browser of the targeted user or access sensitive, browser-based information.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Authentication bypass in Cisco Integrated Management Controller (IMC) allows unauthenticated remote attackers to gain ad
UEFI Secure Boot bypass in Cisco UCS Servers and UCS-based appliances allows authenticated users with 'user' or 'admin'
Command injection in Cisco IMC web management interface allows authenticated admin-level attackers to execute arbitrary
Command injection in Cisco IMC web-based management interface allows authenticated remote attackers with admin-level pri
Reflected XSS in Cisco IMC web management interface allows unauthenticated remote attackers to execute arbitrary JavaScr
Cross-site scripting in the Cisco Integrated Management Controller (IMC) web-based management interface allows an authen
Stored cross-site scripting (XSS) in Cisco IMC web management interface allows authenticated administrators to inject pe
Stored XSS in Cisco IMC web management interface allows authenticated administrators to inject arbitrary script code via
Stored cross-site scripting (XSS) in Cisco IMC web management interface allows authenticated administrators to inject ma
Exploit-DB