CVE-2024-20270

CVE-2024-20270 describes a stored cross-site scripting (XSS) vulnerability in the web-based management interfaces of Cisco BroadWorks Application Delivery Platform and Cisco BroadWorks Xtended Services Platform. This flaw stems from insufficient input validation, allowing an authenticated, remote attacker to inject malicious script code. A successful exploit, requiring user interaction (clicking a crafted link), could lead to arbitrary script execution in the user's browser or access to sensitive browser-based information. The vulnerability has a CVSS score of 5.4 (Medium), indicating a low attack complexity and requiring user interaction, with potential for limited confidentiality and integrity impact. The EPSS score is very low, suggesting a minimal likelihood of exploitation in the wild. Currently, there is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are also minimal, indicating low public attention.