Vulnerability · Published Sep 24, 2025 · Assigned by cisco
CVE-2025-20240
Medium 6.1
In plain English
A medium-severity security flaw in Cisco IOS XE Software from Cisco. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 29% of all known vulnerabilities).
Official description
A vulnerability in the Web Authentication feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting attack (XSS) on an affected device. This vulnerability is due to improper sanitization of user-supplied input. An attacker could exploit this vulnerability by persuading a user to click a malicious link. A successful exploit could allow the attacker to execute a reflected XSS attack and steal user cookies from the affected device.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Cisco | Cisco IOS XE Software | 16.6.116.6.216.6.316.6.416.6.516.6.4a16.6.5a16.6.6 |
Weakness: CWE-692 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N