SB2026060402 - Remote file inclusion in Cisco Finesse

Description

This security bulletin contains information about 1 vulnerability.

1) External Control of File Name or Path (CVE-ID: CVE-2026-20175)

CWE-ID: CWE-73 - External Control of File Name or Path

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to execute arbitrary script code in the context of the affected interface or disclose sensitive information.

The vulnerability exists due to external control of file name or path in HTTP request handling in Cisco Finesse when processing user-supplied input in crafted links sent to an affected device. A remote attacker can persuade a user to click a crafted link containing the affected device address to execute arbitrary script code in the context of the affected interface or disclose sensitive information.

User interaction is required to click a crafted link.

Remediation

Install update from vendor's website.

References

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-finesse-rfi-gwpkdc89 
• https://bst.cloudapps.cisco.com/bugsearch/bug/CSCws76655