This vulnerability in Cisco Enterprise NFV Infrastructure Software's web management interface permits stored XSS attacks by authenticated administrators due to improper input validation. An attacker with administrative access can inject malicious scripts that execute in the context of other users' browsers when they interact with crafted links. This could lead to unauthorized script execution or exposure of sensitive information within the browser session. The issue affects numerous versions of the software as listed. The CVSS 3.1 vector indicates network attack vector, low attack complexity, high privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity, with no impact on availability.

Successful exploitation allows an authenticated attacker with administrative privileges to execute arbitrary scripts in the browsers of other users of the management interface. This can lead to unauthorized access to sensitive browser-based information or actions performed on behalf of the victim user within the interface. The impact is limited to confidentiality and integrity with no direct impact on availability. The vulnerability requires user interaction and administrative privileges, reducing the likelihood of exploitation by lower-privileged attackers.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor Cisco's advisories for updates. Until a fix is available, limit administrative access to trusted personnel and exercise caution when clicking links within the management interface. Employing web application firewalls or input validation controls may help reduce risk but are not substitutes for an official fix.