CVE-2025-20307 is a cross-site scripting (XSS) vulnerability in the web-based management interface of Cisco BroadWorks CommPilot Application Software. An authenticated, remote attacker can exploit this by injecting malicious input due to insufficient validation, allowing arbitrary script execution or access to sensitive browser information. Rated Medium (CVSS 4.8), this vulnerability requires high privileges (PR:H) and user interaction (UI:R) for successful exploitation, with a low impact on confidentiality and integrity. The attack complexity is low (AC:L). Currently, there is no public exploit code available (Metasploit, Nuclei, ExploitDB: None), and it is not listed in CISA's KEV catalog. Community discussion and media coverage are minimal, suggesting low active exploitation or widespread awareness.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< RI.2025.05CPE matchmatch criteria | cpe:2.3:a:cisco:broadworks_application_delivery_platform:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.