EUVD-2026-62562
GHSA-86m3-qpw9-pwm9
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
AV:N for network-reachable web interface, PR:L as valid credentials required, UI:R as victim must view page, S:C as XSS executes in another user's session context.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability in the web-based management interface of Cisco Industrial Ethernet (IE) 1000 Series Switches could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface.
This vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected system. An attacker could exploit this vulnerability by injecting malicious code into specific pages of the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of another user. To exploit this vulnerability, the attacker must have valid user credentials on the affected system.
AnalysisAI
Stored cross-site scripting in the Cisco Industrial Ethernet 1000 Series Switch web-based management interface allows an authenticated remote attacker to inject persistent malicious scripts into interface pages, which then execute in the browser context of other authenticated users. Affected firmware spans versions 1.1 through 1.9.5 across the IE 1000 product line, as confirmed by EUVD-2026-62562 and the Cisco security advisory. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires valid user credentials on the Cisco IE 1000 switch (confirmed by CVSS PR:L), meaning the attacker must have been granted an account on the affected device - either legitimately or through prior compromise. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 5.4 medium score appropriately reflects the dual constraints of required authentication (PR:L) and mandatory victim interaction (UI:R), which substantially limit the realistic attacker pool compared to unauthenticated or self-executing vulnerabilities. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Consult the Cisco security advisory at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ie1k-NgXUFF52 for the patched firmware version and upgrade instructions; no specific fixed version number is present in the available intelligence, so the advisory is the authoritative source for exact remediation targets. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-80 – Basic XSS
View allShare
External POC / Exploit Code
Leaving vuln.today