CVE-2025-20216
Cisco Catalyst SD-WAN Manager Reflected HTML Injection Vulnerability
Description
A vulnerability in the web interface of Cisco Catalyst SD-WAN Manager, formerly Cisco SD-WAN vManage, could allow an unauthenticated, remote attacker to inject HTML into the browser of an authenticated user. This vulnerability is due to improper sanitization of input to the web interface. An attacker could exploit this vulnerability by convincing an authenticated user to click a malicious link. A successful exploit could allow the attacker to inject HTML into the browser of an authenticated Cisco Catalyst SD-WAN Manager user.
Weakness: CWE-74
Affected products
| Vendor | Product | Category | Matched by |
|---|---|---|---|
| Cisco | Cisco Catalyst SD-WAN Manager | Network & Security Management | cna-assigner |
Vendor-reported products (1)
- Cisco · Cisco Catalyst SD-WAN Manager
Vendor advisory
cisco-sa-vmanage-html-inj-GxVtK6zj
Cisco Catalyst SD-WAN Manager Reflected HTML Injection Vulnerability
Cisco’s rating: Medium (advisory CVSS 4.7) · Published May 7, 2025
Bug ID: CSCwk90639
The vendor’s rating applies to the whole advisory and can differ from this CVE’s own CVSS severity. Where this comes from