CVE-2025-20123

Multiple vulnerabilities in the web-based management interface of Cisco Crosswork Network Controller could allow an authenticated, remote attacker to conduct cross-site scripting (XSS) attacks against users of the interface of an affected system. These vulnerabilities exist because the web-based management interface does not properly validate user-supplied input. An attacker could exploit these vulnerabilities by inserting malicious data into specific data fields in the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. To exploit these vulnerabilities, the attacker must have valid administrative credentials. Cisco has released software updates that address these vulnerabilities. There are no workarounds that address these vulnerabilities.

• CWE-79

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-xwork-xss-KCcg7WwUVendor Advisory

Published

Jan 8, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-20117A vulnerability in the CLI of Cisco APIC could allow an auth…6.7
• CVE-2025-20118A vulnerability in the implementation of the internal system…4.4
• CVE-2025-20119A vulnerability in the system file permission handling of Ci…5.7
• CVE-2025-2012Ashlar-Vellum Cobalt VS File Parsing Out-Of-Bounds Read Remo…7.8
• CVE-2025-20120A vulnerability in the web-based management interface of Cis…6.1
• CVE-2025-20122A vulnerability in the CLI of Cisco Catalyst SD-WAN Manager,…7.8
• CVE-2025-20124A vulnerability in an API of Cisco ISE could allow an authen…7.2
• CVE-2025-20125A vulnerability in an API of Cisco ISE could allow an authen…7.2
• CVE-2025-20126A vulnerability in certification validation routines of Cisc…4.8
• CVE-2025-20127A vulnerability in the TLS 1.3 implementation for a specific…7.7
• CVE-2025-20128A vulnerability in the Object Linking and Embedding 2 (OLE2)…7.5
• CVE-2025-20129A vulnerability in the web-based chat interface of Cisco Cus…5.4