CISCO-SA-VMANAGE-HTML-INJ-GXVTK6ZJ

CISCO-SA-VMANAGE-HTML-INJ-GXVTK6ZJ PUBLISHED CVSS 4.699999809265137 MEDIUM

Record from circl · Published May 7, 2025

A vulnerability in the web interface of Cisco Catalyst SD-WAN Manager, formerly Cisco SD-WAN vManage, could allow an unauthenticated, remote attacker to inject HTML into the browser of an authenticated user. This vulnerability is due to improper sanitization of input to the web interface. An attacker could exploit this vulnerability by convincing an authenticated user to click a malicious link. A successful exploit could allow the attacker to inject HTML into the browser of an authenticated Cisco Catalyst SD-WAN Manager user. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

Risk scores

CVSS 3.1

4.699999809265137

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N

Affected products

Vendor	Product	Versions
	Cisco Catalyst SD-WAN Manager

Timeline

May 7, 2025 CVE Published

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln CISCO-SA-VMANAGE-HTML-INJ-GXVTK6ZJ
vulnetix vdb fixes CISCO-SA-VMANAGE-HTML-INJ-GXVTK6ZJ

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/CISCO-SA-VMANAGE-HTML-INJ-GXVTK6ZJ/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

Look up in the Resolve Platform →