6.1
Medium
CVE-2025-20179 A vulnerability in the web-based management interface of Cisco Expressway Series could allow an unauthenticated,…
Description
A vulnerability in the web-based management interface of Cisco Expressway Series could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. This vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. Note: Cisco Expressway Series refers to Cisco Expressway Control (Expressway-C) devices and Cisco Expressway Edge (Expressway-E) devices.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Cisco TelePresence Video Communication Server (VCS) Expressway | Versions not published |
References
- cisco-sa-expressway-xss-uexUZrEW sec.cloudapps.cisco.com
Timeline
- Published
- Last modified
Other CVEs of Cisco TelePresence Video Communication Server (VCS) Expressway
The 33 CVEs of Cisco TelePresence Video Communication Server (VCS) Expressway →
CVE-2026-76497
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software…
6.6
Medium
CVE-2026-76496
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software…
7.0
High
CVE-2026-76495
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software…
7.8
High
CVE-2026-76494
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software…
7.8
High