CVE-2025-20147

What it is

A vulnerability in the web-based management interface of Cisco Catalyst SD-WAN Manager, formerly Cisco SD-WAN vManage, could allow an authenticated, remote attacker to conduct a stored cross-site scripting attack (XSS) on an affected system.  This vulnerability is due to improper sanitization of user input to the web-based management interface. An attacker could exploit this vulnerability by submitting a malicious script through the interface. A successful exploit could allow the attacker to conduct a stored XSS attack on the affected system.

At a glance

Exploitability

Can be exploited over the network with a low-privilege account, but needs a user to act. Limited direct impact.

Exploit odds

0.4% chance of exploitation in the next 30 days (EPSS).

Fix

A patch, advisory or fixed version is referenced. Upgrade or apply it.

Timeline

1. 2025-05-07 18:15 UTC PublishedDisclosed publicly on CVE.org and NVD
2. 2026-06-17 08:40 UTC Last updatedMost recent change to the record

Details

Published

2025-05-07 18:15 UTC

Last modified

2026-06-17 08:40 UTC

Exploit probability

0.4% · EPSS, next 30 days

Weakness

CWE-79 · Cross-site scripting

Record status

Analyzed

Affected

• Cisco Catalyst sd-wan Manager 17.2.4
• Cisco Catalyst sd-wan Manager 17.2.5
• Cisco Catalyst sd-wan Manager 17.2.6
• Cisco Catalyst sd-wan Manager 17.2.7
• Cisco Catalyst sd-wan Manager 17.2.8
• Cisco Catalyst sd-wan Manager 17.2.9
• Cisco Catalyst sd-wan Manager 17.2.10
• Cisco Catalyst sd-wan Manager 18.2.0

Attack profile CVSS 3.1 · 5.4

Attack vector

Network

Complexity

Low

Privileges needed

Low

User interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None