CVE-2025-20166

What it is

A vulnerability in the web-based management interface of Cisco Common Services Platform Collector (CSPC) could allow an authenticated, remote attacker to conduct cross-site scripting (XSS) attacks against a user of the interface. This vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected system. An attacker could exploit this vulnerability by injecting malicious code into specific pages of the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. To exploit this vulnerability, the attacker must have at least a low-privileged account on an affected device. Cisco has not released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

At a glance

Exploitability

Can be exploited over the network with a low-privilege account, but needs a user to act. Limited direct impact.

Exploit odds

0.4% chance of exploitation in the next 30 days (EPSS).

Fix

A patch, advisory or fixed version is referenced. Upgrade or apply it.

Timeline

1. 2025-01-08 17:15 UTC PublishedDisclosed publicly on CVE.org and NVD
2. 2026-06-17 08:40 UTC Last updatedMost recent change to the record

Details

Published

2025-01-08 17:15 UTC

Last modified

2026-06-17 08:40 UTC

Exploit probability

0.4% · EPSS, next 30 days

Weakness

CWE-86

Record status

Analyzed

Affected

• Cisco Crosswork Network Controller < 5.0.4
• Cisco Crosswork Network Controller < 6.0.3
• Cisco Crosswork Network Controller < 7.0.1
• Cisco Common Services Platform Collector 2.11
• Cisco Common Services Platform Collector 2.11.0.1
• Cisco Common Services Platform Collector 2.11.0.2
• Cisco Common Services Platform Collector 2.11.0.3
• Cisco Common Services Platform Collector 30.1.1-0

Attack profile CVSS 3.1 · 5.4

Attack vector

Network

Complexity

Low

Privileges needed

Low

User interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None