CVEvulnerability

CVE-2026-20108

5.4 MEDIUM Published 2026-03-25 Modified 2026-06-29 Official page ↗
Status
Analyzed
Published
2026-03-25
Last modified
2026-06-29
Assigner
[email protected]
CVSS 3.1 ([email protected])
5.4 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79

Description

A vulnerability in the web-based management interface of Cisco Catalyst SD-WAN Manager could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface of an affected device. This vulnerability is due to insufficient validation of user input. An attacker could exploit this vulnerability by persuading a user of the web-based management interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.

Affected configurations

• cisco catalyst sd-wan manager (>= 20.12 < 20.12.5.3) • cisco catalyst sd-wan manager (>= 20.13 < 20.15.4.2) • cisco catalyst sd-wan manager (>= 20.16 < 20.18.2.1) • cisco catalyst sd-wan manager 20.12.6

Related

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References