CVE-2025-20211 Details
Description
A vulnerability in the web-based management interface of Cisco BroadWorks Application Delivery Platform could allow an unauthenticated, remote attacker to conduct a cross-site scripting attack against a user of the interface. This vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.
A cross-site scripting vulnerability has been identified in the web-based management interface of Cisco BroadWorks Application Delivery Platform. This issue allows an unauthenticated, remote attacker to execute arbitrary script code in the context of the affected interface or access sensitive browser-based information. The vulnerability arises because the interface fails to properly validate user-supplied input. An attacker could exploit this by persuading a user to click a crafted link.
Cisco has released patches for this vulnerability. Users can upgrade to version 24_2025.01_1.310 of the BroadWorks Call Center or Receptionist applications. For BroadWorks versions 25.0, users should migrate to a fixed release. Instructions for upgrading can be found on the Cisco Security Advisories page.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Feb 19, 2025CISA-ADP
Assessed Feb 19, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-broadworks-xss-GDPgJ58P | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Cisco BroadWorks Application Delivery Platform | All versions |
CPE
Remediation
| |
| Cisco BroadWorks Call Center | All versions |
CPE
Remediation
| |
| Cisco BroadWorks Receptionist | All versions |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Feb 19, 2025 | New CVE Received | [email protected] |