A vulnerability in the web-based management interface of Cisco IMC could allow an unauthenticated, remote attacker to conduct a reflected XSS attack against a user of the interface. This vulnerability is due to insufficient validation…

Overview

A vulnerability in the web-based management interface of Cisco IMC could allow an unauthenticated, remote attacker to conduct a reflected XSS attack against a user of the interface.

This vulnerability is due to insufficient validation of user input. An attacker could exploit this vulnerability by persuading a user of an affected interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the browser of the targeted user or access sensitive, browser-based information.

Affected

• enterprise_nfv_infrastructure_software = 3.3.1
• enterprise_nfv_infrastructure_software = 3.4.1
• enterprise_nfv_infrastructure_software = 3.5.1
• enterprise_nfv_infrastructure_software = 3.5.2
• enterprise_nfv_infrastructure_software = 3.6.1
• enterprise_nfv_infrastructure_software = 3.6.2
• enterprise_nfv_infrastructure_software = 3.6.3
• enterprise_nfv_infrastructure_software = 3.7.1
• enterprise_nfv_infrastructure_software = 3.8.1
• enterprise_nfv_infrastructure_software = 3.9.1
• enterprise_nfv_infrastructure_software = 3.9.2
• enterprise_nfv_infrastructure_software = 3.10.1
• enterprise_nfv_infrastructure_software = 3.10.2
• enterprise_nfv_infrastructure_software = 3.10.3
• enterprise_nfv_infrastructure_software = 3.11.1
• enterprise_nfv_infrastructure_software = 3.11.2
• enterprise_nfv_infrastructure_software = 3.11.3
• enterprise_nfv_infrastructure_software = 3.12.1
• enterprise_nfv_infrastructure_software = 3.12.1a
• enterprise_nfv_infrastructure_software = 3.12.1b
• enterprise_nfv_infrastructure_software = 3.12.2
• enterprise_nfv_infrastructure_software = 3.12.3
• enterprise_nfv_infrastructure_software = 4.1.1
• enterprise_nfv_infrastructure_software = 4.1.2
• enterprise_nfv_infrastructure_software = 4.2.1
• enterprise_nfv_infrastructure_software = 4.2.2
• enterprise_nfv_infrastructure_software = 4.4.1
• enterprise_nfv_infrastructure_software = 4.4.2
• enterprise_nfv_infrastructure_software = 4.4.3
• enterprise_nfv_infrastructure_software = 4.5.1
• enterprise_nfv_infrastructure_software = 4.6.1
• enterprise_nfv_infrastructure_software = 4.6.2
• enterprise_nfv_infrastructure_software = 4.6.2-fc2
• enterprise_nfv_infrastructure_software = 4.6.2-fc3
• enterprise_nfv_infrastructure_software = 4.6.3
• enterprise_nfv_infrastructure_software = 4.6.3-fc4
• enterprise_nfv_infrastructure_software = 4.6.4
• enterprise_nfv_infrastructure_software = 4.6.5-es1
• enterprise_nfv_infrastructure_software = 4.7.1
• enterprise_nfv_infrastructure_software = 4.8.1
• enterprise_nfv_infrastructure_software = 4.8.2
• enterprise_nfv_infrastructure_software = 4.9.1
• enterprise_nfv_infrastructure_software = 4.9.2
• enterprise_nfv_infrastructure_software = 4.9.2-fc5
• enterprise_nfv_infrastructure_software = 4.9.3
• enterprise_nfv_infrastructure_software = 4.9.4
• enterprise_nfv_infrastructure_software = 4.9.4-es8
• enterprise_nfv_infrastructure_software = 4.9.4-es9
• enterprise_nfv_infrastructure_software = 4.9.5
• enterprise_nfv_infrastructure_software = 4.9.6
• enterprise_nfv_infrastructure_software = 4.10.1
• enterprise_nfv_infrastructure_software = 4.11.1
• enterprise_nfv_infrastructure_software = 4.12.1
• enterprise_nfv_infrastructure_software = 4.12.2
• enterprise_nfv_infrastructure_software = 4.12.3
• enterprise_nfv_infrastructure_software = 4.12.4
• enterprise_nfv_infrastructure_software = 4.12.5
• enterprise_nfv_infrastructure_software = 4.12.6
• enterprise_nfv_infrastructure_software = 4.13.1
• enterprise_nfv_infrastructure_software = 4.14.1
• enterprise_nfv_infrastructure_software = 4.15.1
• enterprise_nfv_infrastructure_software = 4.15.2
• enterprise_nfv_infrastructure_software = 4.15.3
• enterprise_nfv_infrastructure_software = 4.15.4
• enterprise_nfv_infrastructure_software = 4.16.1
• enterprise_nfv_infrastructure_software = 4.18.1
• enterprise_nfv_infrastructure_software = 4.18.2
• enterprise_nfv_infrastructure_software = 4.18.2a
• unified_computing_system = 3.1(1d)
• unified_computing_system = 3.1(2b)
• unified_computing_system = 3.1(2c)
• unified_computing_system = 3.1(2d)
• unified_computing_system = 3.1(2e)
• unified_computing_system = 3.1(2g)
• unified_computing_system = 3.1(2i)
• unified_computing_system = 3.1(3a)
• unified_computing_system = 3.1(3b)
• unified_computing_system = 3.1(3c)
• unified_computing_system = 3.1(3d)
• unified_computing_system = 3.1(3g)
• unified_computing_system = 3.1(3h)
• unified_computing_system = 3.1(3i)
• unified_computing_system = 3.1(3j)
• unified_computing_system = 3.1(3k)
• unified_computing_system = 4.0(1.240)
• unified_computing_system = 4.0(1a)
• unified_computing_system = 4.0(1b)
• unified_computing_system = 4.0(1c)
• unified_computing_system = 4.0(1d)
• unified_computing_system = 4.0(1e)
• unified_computing_system = 4.0(1g)
• unified_computing_system = 4.0(1h)
• unified_computing_system = 4.0(2c)
• unified_computing_system = 4.0(2d)
• unified_computing_system = 4.0(2f)
• unified_computing_system = 4.0(2g)
• unified_computing_system = 4.0(2h)
• unified_computing_system = 4.0(2i)
• unified_computing_system = 4.0(2l)
• unified_computing_system = 4.0(2n)

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

Vendor advisories

• cisco-sa-cimc-xss-A2tkgVAB · Cisco · affected: Cisco Unified Computing System (Standalone) (144 versions), Cisco Unified Computing System E-Series Software (UCSE) (29 versions), Cisco Enterprise NFV Infrastructure Software (58 versions) · updated 2026-04-22 · advisory