This vulnerability arises from improper neutralization of input during web page generation in Cisco Integrated Management Controller (IMC). An authenticated remote attacker can exploit insufficient validation of user input in the web interface to conduct a cross-site scripting (XSS) attack. Successful exploitation requires tricking a user into clicking a crafted link, enabling execution of arbitrary script code in the victim's browser or access to sensitive information. The vulnerability affects multiple specific versions of Cisco Enterprise NFV Infrastructure Software as listed.

Exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the targeted user's browser session on the Cisco IMC web interface. This may lead to disclosure of sensitive information accessible through the browser or other actions permitted by the user's privileges. The vulnerability requires the attacker to be authenticated and to convince a user to interact with a malicious link. There is no indication of impact on system availability or integrity beyond the browser context.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is currently documented. Until a patch is available, users should exercise caution with links received in the management interface context and limit authenticated user access to trusted personnel only.