4.8
Medium
CVE-2025-20307 A vulnerability in the web-based management interface of Cisco BroadWorks CommPilot Application Software could allow…
Description
A vulnerability in the web-based management interface of Cisco BroadWorks CommPilot Application Software could allow an authenticated, remote attacker to conduct cross-site scripting (XSS) attacks against a user of the interface. This vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected system. An attacker could exploit this vulnerability by injecting malicious code into specific pages of the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. To exploit this vulnerability, the attacker must have valid administrative credentials.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Cisco BroadWorks | 26.0 | No fix stated |
| Cisco BroadWorks | 25.0 | No fix stated |
| Cisco BroadWorks | 24.0 | No fix stated |
| Cisco BroadWorks | 23.0 | No fix stated |
| Cisco BroadWorks | 22.0 | No fix stated |
| Cisco BroadWorks | 21.0 | No fix stated |
| Cisco BroadWorks | 21.sp1 | No fix stated |
Other CVEs of Cisco BroadWorks
The 21 CVEs of Cisco BroadWorks →
CVE-2026-76438
A vulnerability in the web-based management interface of Cisco BroadWorks CommPilot Application Software could allow…
6.5
Medium
CVE-2026-20320
A vulnerability in the Open Client Interface (OCI) XML Parser of Cisco BroadWorks could allow an unauthenticated, remote…
7.5
High
CVE-2025-20211
A vulnerability in the web-based management interface of Cisco BroadWorks Application Delivery Platform could allow an…
6.1
Medium
CVE-2025-20165
A vulnerability in the SIP processing subsystem of Cisco BroadWorks could allow an unauthenticated, remote attacker to…
7.5
High