CVE-2025-20342: Cisco Unified Computing System (Managed) · Basic XSS
Affects Cisco Unified Computing System (Managed)Source CVE Database V5
Not known to be exploited · CVSS 5.4 Medium.
Data as of 26 Oct 2026, 06:26 UTC
- EPSS
- 0.2% chance of exploitation in 30 days – higher than 13% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NExploitation evidence
Disclosed: evidence found.
CVE published 27 Aug 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-26.
What to do
AI-suggested
To mitigate this vulnerability effectively, European organizations should: 1) Immediately identify and inventory all Cisco UCS Manager and IMC instances in their environment, noting versions to assess exposure. 2) Apply Cisco-released patches or updates as soon as they become available, prioritizing environments with multiple vKVM users. 3) Restrict vKVM access privileges strictly on a need-to-use basis, minimizing the number of users with such permissions. 4) Implement multi-factor authentication (MFA) for management interfaces to reduce the risk of credential compromise. 5) Monitor management interface logs for unusual input patterns or repeated failed attempts that could indicate exploitation attempts. 6) Educate administrators and users with vKVM access about the risks of stored XSS and encourage cautious behavior when interacting with management interfaces. 7) Where possible, isolate management interfaces from general network access using network segmentation and VPNs to limit exposure. 8) Employ web application firewalls (WAFs) or intrusion detection systems (IDS) tuned to detect and block XSS payloads targeting management interfaces. These measures, combined, reduce the likelihood of successful exploitation and limit potential damage.
Description
A vulnerability in the Virtual Keyboard Video Monitor (vKVM) connection handling of Cisco Integrated Management Controller (IMC) could allow an authenticated, remote attacker with low privileges to conduct a stored cross-site scripting (XSS) attack against a user of the interface. This vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected system. An attacker could exploit this vulnerability by injecting malicious code into a specific data field in the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. To exploit this vulnerability, the attacker must have valid user credentials with privileges that allow for vKVM access on the affected device. Note: The affected vKVM client is also included in Cisco UCS Manager.