#VU62334 Stored cross-site scripting in Cisco Systems, Inc products - CVE-2022-20725

Vulnerability identifier: #VU62334

Vulnerability risk: Low

CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear

CVE-ID: CVE-2022-20725

CWE-ID: CWE-79

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerable software:
800 Series Industrial Integrated Services Routers
Industrial Ethernet 4000 Series Switches
800 Series Integrated Services Routers
Cisco 1000 Series Integrated Services Routers
4000 Series Integrated Services Routers
Cisco ASR 1000 Series Aggregation Services Routers
Catalyst 9x00 Series Switches
Catalyst IE3400 Rugged Series
Embedded Services 3300 Series Switches
IR510 WPAN Industrial Routers
IC3000 Industrial Compute Gateway
CGR1000 Compute Modules
Cisco IOx
Cisco IOS XE
Cisco IOS

Software vendor:
Cisco Systems, Inc

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data in the web-based Local Manager interface. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iox-yuXQ6hFj