This vulnerability involves improper neutralization of input during web page generation in Cisco Enterprise NFV Infrastructure Software's web management interface. Specifically, insufficient input validation allows an unauthenticated remote attacker to conduct a reflected XSS attack by persuading a user to click a maliciously crafted link. Successful exploitation enables execution of arbitrary script code in the victim's browser or access to sensitive information accessible via the browser. The vulnerability affects numerous versions across the 3.x and 4.x release lines. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low confidentiality and integrity impacts with no availability impact.

Exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the affected user's browser session, potentially leading to theft of sensitive browser-based information or other malicious actions within the scope of the user's privileges. The vulnerability does not impact system availability. The medium CVSS score reflects moderate risk due to the need for user interaction and the limited confidentiality and integrity impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided in the available data, users should monitor Cisco's advisories for updates. In the meantime, users should exercise caution when clicking links related to the Cisco Enterprise NFV Infrastructure Software management interface and consider restricting access to the interface to trusted users only.