{"success":true,"data":{"threats":[{"id":"96b81ad5-74ba-4773-bb25-90218b88cba0","slug":"cve-2025-20240","externalId":"CVE-2025-20240","source":"NVD","sourceType":"cve-db","type":"vulnerability","title":"CVE-2025-20240 — A vulnerability in the Web Authentication feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to conduct a reflected c…","description":"A vulnerability in the Web Authentication feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting attack (XSS) on an affected device.\r\n\r This vulnerability is due to improper sanitization of user-supplied input. An attacker could exploit this vulnerability by persuading a user to click a malicious link. A successful exploit could allow the attacker to execute a reflected XSS attack and steal user cookies from the affected device.","cveId":"CVE-2025-20240","cvssScore":6.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","severity":"medium","vendor":null,"product":null,"affectedVersions":[],"cwes":["CWE-692"],"tags":["nvd","status:deferred"],"relatedCves":[],"titleFingerprint":null,"countryCodes":[],"knownExploited":false,"patchAvailable":false,"patchLinks":[],"references":[{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webui-xss-VWyDgjOU","type":"advisory","title":"psirt@cisco.com"}],"epssScore":0.0029,"epssPercentile":0.19734,"nucleiTemplatePath":null,"nucleiSeverity":null,"enrichment":null,"publishedAt":"2025-09-24T18:15:34.333Z","addedAt":"2026-09-26T01:50:41.525Z","updatedAt":"2026-09-26T01:50:41.525Z","epssUpdatedAt":"2026-10-08T12:00:21.000Z","nucleiUpdatedAt":null,"links":[{"label":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-20240","note":"ingested from NVD"},{"label":"CVE Program","url":"https://www.cve.org/CVERecord?id=CVE-2025-20240","note":"authoritative record"}],"raw":{"id":"CVE-2025-20240","cveTags":[],"metrics":{"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-20240","role":"CISA Coordinator","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"version":"2.0.3","timestamp":"2025-09-24T17:31:05.188656Z"}}],"cvssMetricV31":[{"type":"Secondary","source":"psirt@cisco.com","cvssData":{"scope":"CHANGED","version":"3.1","baseScore":6.1,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","integrityImpact":"LOW","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"LOW"},"impactScore":2.7,"exploitabilityScore":2.8}]},"affected":[{"source":"psirt@cisco.com","affectedData":[{"vendor":"Cisco","product":"Cisco IOS XE Software","versions":[{"status":"affected","version":"16.6.1"},{"status":"affected","version":"16.6.2"},{"status":"affected","version":"16.6.3"},{"status":"affected","version":"16.6.4"},{"status":"affected","version":"16.6.5"},{"status":"affected","version":"16.6.4a"},{"status":"affected","version":"16.6.5a"},{"status":"affected","version":"16.6.6"},{"status":"affected","version":"16.6.7"},{"status":"affected","version":"16.6.8"},{"status":"affected","version":"16.6.9"},{"status":"affected","version":"16.6.10"},{"status":"affected","version":"16.7.1"},{"status":"affected","version":"16.7.1a"},{"status":"affected","version":"16.7.1b"},{"status":"affected","version":"16.7.2"},{"status":"affected","version":"16.7.3"},{"status":"affected","version":"16.7.4"},{"status":"affected","version":"16.8.1"},{"status":"affected","version":"16.8.1a"},{"status":"affected","version":"16.8.1b"},{"status":"affected","version":"16.8.1s"},{"status":"affected","version":"16.8.1c"},{"status":"affected","version":"16.8.1d"},{"status":"affected","version":"16.8.2"},{"status":"affected","version":"16.8.1e"},{"status":"affected","version":"16.8.3"},{"status":"affected","version":"16.9.1"},{"status":"affected","version":"16.9.2"},{"status":"affected","version":"16.9.1a"},{"status":"affected","version":"16.9.1b"},{"status":"affected","version":"16.9.1s"},{"status":"affected","version":"16.9.3"},{"status":"affected","version":"16.9.4"},{"status":"affected","version":"16.9.3a"},{"status":"affected","version":"16.9.5"},{"status":"affected","version":"16.9.5f"},{"status":"affected","version":"16.9.6"},{"status":"affected","version":"16.9.7"},{"status":"affected","version":"16.9.8"},{"status":"affected","version":"16.10.1"},{"status":"affected","version":"16.10.1a"},{"status":"affected","version":"16.10.1b"},{"status":"affected","version":"16.10.1s"},{"status":"affected","version":"16.10.1c"},{"status":"affected","version":"16.10.1e"},{"status":"affected","version":"16.10.1d"},{"status":"affected","version":"16.10.2"},{"status":"affected","version":"16.10.1f"},{"status":"affected","version":"16.10.1g"},{"status":"affected","version":"16.10.3"},{"status":"affected","version":"16.11.1"},{"status":"affected","version":"16.11.1a"},{"status":"affected","version":"16.11.1b"},{"status":"affected","version":"16.11.2"},{"status":"affected","version":"16.11.1s"},{"status":"affected","version":"16.12.1"},{"status":"affected","version":"16.12.1s"},{"status":"affected","version":"16.12.1a"},{"status":"affected","version":"16.12.1c"},{"status":"affected","version":"16.12.1w"},{"status":"affected","version":"16.12.2"},{"status":"affected","version":"16.12.1y"},{"status":"affected","version":"16.12.2a"},{"status":"affected","version":"16.12.3"},{"status":"affected","version":"16.12.8"},{"status":"affected","version":"16.12.2s"},{"status":"affected","version":"16.12.1x"},{"status":"affected","version":"16.12.1t"},{"status":"affected","version":"16.12.4"},{"status":"affected","version":"16.12.3s"},{"status":"affected","version":"16.12.3a"},{"status":"affected","version":"16.12.4a"},{"status":"affected","version":"16.12.5"},{"status":"affected","version":"16.12.6"},{"status":"affected","version":"16.12.1z1"},{"status":"affected","version":"16.12.5a"},{"status":"affected","version":"16.12.5b"},{"status":"affected","version":"16.12.1z2"},{"status":"affected","version":"16.12.6a"},{"status":"affected","version":"16.12.7"},{"status":"affected","version":"16.12.9"},{"status":"affected","version":"16.12.10"},{"status":"affected","version":"16.12.10a"},{"status":"affected","version":"16.12.11"},{"status":"affected","version":"16.12.12"},{"status":"affected","version":"16.12.13"},{"status":"affected","version":"17.1.1"},{"status":"affected","version":"17.1.1a"},{"status":"affected","version":"17.1.1s"},{"status":"affected","version":"17.1.1t"},{"status":"affected","version":"17.1.3"},{"status":"affected","version":"17.2.1"},{"status":"affected","version":"17.2.1r"},{"status":"affected","version":"17.2.1a"},{"status":"affected","version":"17.2.1v"},{"status":"affected","version":"17.2.2"},{"status":"affected","version":"17.2.3"},{"status":"affected","version":"17.3.1"},{"status":"affected","version":"17.3.2"},{"status":"affected","version":"17.3.3"},{"status":"affected","version":"17.3.1a"},{"status":"affected","version":"17.3.1w"},{"status":"affected","version":"17.3.2a"},{"status":"affected","version":"17.3.1x"},{"status":"affected","version":"17.3.1z"},{"status":"affected","version":"17.3.4"},{"status":"affected","version":"17.3.5"},{"status":"affected","version":"17.3.4a"},{"status":"affected","version":"17.3.6"},{"status":"affected","version":"17.3.4b"},{"status":"affected","version":"17.3.4c"},{"status":"affected","version":"17.3.5a"},{"status":"affected","version":"17.3.5b"},{"status":"affected","version":"17.3.7"},{"status":"affected","version":"17.3.8"},{"status":"affected","version":"17.3.8a"},{"status":"affected","version":"17.4.1"},{"status":"affected","version":"17.4.2"},{"status":"affected","version":"17.4.1a"},{"status":"affected","version":"17.4.1b"},{"status":"affected","version":"17.4.2a"},{"status":"affected","version":"17.5.1"},{"status":"affected","version":"17.5.1a"},{"status":"affected","version":"17.6.1"},{"status":"affected","version":"17.6.2"},{"status":"affected","version":"17.6.1w"},{"status":"affected","version":"17.6.1a"},{"status":"affected","version":"17.6.1x"},{"status":"affected","version":"17.6.3"},{"status":"affected","version":"17.6.1y"},{"status":"affected","version":"17.6.1z"},{"status":"affected","version":"17.6.3a"},{"status":"affected","version":"17.6.4"},{"status":"affected","version":"17.6.1z1"},{"status":"affected","version":"17.6.5"},{"status":"affected","version":"17.6.6"},{"status":"affected","version":"17.6.6a"},{"status":"affected","version":"17.6.5a"},{"status":"affected","version":"17.6.7"},{"status":"affected","version":"17.6.8"},{"status":"affected","version":"17.6.8a"},{"status":"affected","version":"17.7.1"},{"status":"affected","version":"17.7.1a"},{"status":"affected","version":"17.7.1b"},{"status":"affected","version":"17.7.2"},{"status":"affected","version":"17.10.1"},{"status":"affected","version":"17.10.1a"},{"status":"affected","version":"17.10.1b"},{"status":"affected","version":"17.8.1"},{"status":"affected","version":"17.8.1a"},{"status":"affected","version":"17.9.1"},{"status":"affected","version":"17.9.1w"},{"status":"affected","version":"17.9.2"},{"status":"affected","version":"17.9.1a"},{"status":"affected","version":"17.9.1x"},{"status":"affected","version":"17.9.1y"},{"status":"affected","version":"17.9.3"},{"status":"affected","version":"17.9.2a"},{"status":"affected","version":"17.9.1x1"},{"status":"affected","version":"17.9.3a"},{"status":"affected","version":"17.9.4"},{"status":"affected","version":"17.9.1y1"},{"status":"affected","version":"17.9.5"},{"status":"affected","version":"17.9.4a"},{"status":"affected","version":"17.9.5a"},{"status":"affected","version":"17.9.5b"},{"status":"affected","version":"17.9.6"},{"status":"affected","version":"17.9.6a"},{"status":"affected","version":"17.9.7"},{"status":"affected","version":"17.9.5e"},{"status":"affected","version":"17.9.5f"},{"status":"affected","version":"17.9.7a"},{"status":"affected","version":"17.9.7b"},{"status":"affected","version":"17.11.1"},{"status":"affected","version":"17.11.1a"},{"status":"affected","version":"17.12.1"},{"status":"affected","version":"17.12.1w"},{"status":"affected","version":"17.12.1a"},{"status":"affected","version":"17.12.1x"},{"status":"affected","version":"17.12.2"},{"status":"affected","version":"17.12.3"},{"status":"affected","version":"17.12.2a"},{"status":"affected","version":"17.12.1y"},{"status":"affected","version":"17.12.1z"},{"status":"affected","version":"17.12.4"},{"status":"affected","version":"17.12.3a"},{"status":"affected","version":"17.12.1z1"},{"status":"affected","version":"17.12.1z2"},{"status":"affected","version":"17.12.4a"},{"status":"affected","version":"17.12.5"},{"status":"affected","version":"17.12.4b"},{"status":"affected","version":"17.12.1z3"},{"status":"affected","version":"17.12.5a"},{"status":"affected","version":"17.12.1z4"},{"status":"affected","version":"17.12.5b"},{"status":"affected","version":"17.12.5c"},{"status":"affected","version":"17.13.1"},{"status":"affected","version":"17.13.1a"},{"status":"affected","version":"17.14.1"},{"status":"affected","version":"17.14.1a"},{"status":"affected","version":"17.15.1"},{"status":"affected","version":"17.15.1w"},{"status":"affected","version":"17.15.1a"},{"status":"affected","version":"17.15.2"},{"status":"affected","version":"17.15.1b"},{"status":"affected","version":"17.15.1x"},{"status":"affected","version":"17.15.3"},{"status":"affected","version":"17.15.2c"},{"status":"affected","version":"17.15.2a"},{"status":"affected","version":"17.15.1y"},{"status":"affected","version":"17.15.2b"},{"status":"affected","version":"17.15.3a"},{"status":"affected","version":"17.15.3b"},{"status":"affected","version":"17.16.1"},{"status":"affected","version":"17.16.1a"}]}]}],"published":"2025-09-24T18:15:34.333","references":[{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webui-xss-VWyDgjOU","source":"psirt@cisco.com"}],"vulnStatus":"Deferred","weaknesses":[{"type":"Secondary","source":"psirt@cisco.com","description":[{"lang":"en","value":"CWE-692"}]}],"descriptions":[{"lang":"en","value":"A vulnerability in the Web Authentication feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting attack (XSS) on an affected device.\r\n\r This vulnerability is due to improper sanitization of user-supplied input. An attacker could exploit this vulnerability by persuading a user to click a malicious link. A successful exploit could allow the attacker to execute a reflected XSS attack and steal user cookies from the affected device."},{"lang":"es","value":"Una vulnerabilidad en la característica de autenticación web de Cisco IOS XE Software podría permitir a un atacante remoto no autenticado llevar a cabo un ataque de cross-site scripting (XSS) reflejado en un dispositivo afectado. Esta vulnerabilidad se debe a una sanitización inadecuada de la entrada proporcionada por el usuario. Un atacante podría explotar esta vulnerabilidad persuadiendo a un usuario para que haga clic en un enlace malicioso. Un exploit exitoso podría permitir al atacante ejecutar un ataque de XSS reflejado y robar las cookies del usuario del dispositivo afectado."}],"lastModified":"2026-09-26T00:10:00.127","sourceIdentifier":"psirt@cisco.com"}}],"pagination":{"page":1,"limit":20,"total":1,"totalPages":1,"hasNext":false,"hasPrev":false}},"meta":{"apiVersion":"v1","requestedAt":"2026-10-08T23:50:11.401Z","durationMs":6,"filters":{"search":null,"severity":[],"type":[],"country":[],"tag":[],"cwe":[],"vendor":null,"product":null,"cve":"CVE-2025-20240","source":[],"days":null,"publishedAfter":null,"publishedBefore":null,"minCvss":null,"maxCvss":null,"minEpss":null,"knownExploited":null,"hasPatch":null,"hasNucleiTemplate":null},"sort":"newest","unknownParams":["include"],"warnings":[]}}