Description

A vulnerability in the web-based management interface of Cisco Industrial Ethernet (IE) 1000 Series Switches could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface. This vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected system. An attacker could exploit this vulnerability by injecting malicious code into specific pages of the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of another user. To exploit this vulnerability, the attacker must have valid user credentials on the affected system.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-08-19T17:18:39.390Z",
  "pubdate": "2026-08-19T17:18:39.390Z",
  "executiveSummary": "A stored cross-site scripting (XSS) vulnerability exists within the web-based management interface of Cisco Industrial Ethernet (IE) 1000 Series Switches. The vulnerability stems from insufficient input validation of user-supplied data processed by the affected web interface. An authenticated, remote attacker can exploit this flaw by injecting malicious script payloads into specific pages of the management interface. When another user subsequently accesses the compromised interface pages, the injected arbitrary script code executes within the security context of the victim's browser session. Successful exploitation compromises the confidentiality and integrity of the affected user sessions and allows the execution of unauthorized actions within the administrative interface. The risk implication involves potential session hijacking, administrative action spoofing, and unauthorized interaction with the switch management platform. Exploitation of this vulnerability requires the attacker to possess valid user credentials on the targeted system and network access to the web-based management interface.",
  "technicalDetails": "The root cause of this vulnerability is inadequate input sanitization and output encoding within the web-based management interface of Cisco Industrial Ethernet (IE) 1000 Series Switches. The affected component fails to properly validate and filter user-supplied input strings before persisting them within application storage or reflecting them in subsequent HTTP responses generated for administrative users. This architectural failure allows an authenticated attacker to inject arbitrary client-side scripts, typically JavaScript, into vulnerable input fields or data processing parameters exposed by specific pages of the management interface.\nTo initiate the attack flow, the authenticated attacker interacts with the web-based management interface over the network using valid user credentials. The attacker submits crafted HTTP requests containing malicious script payloads intended for vulnerable storage vectors within the application. The system accepts and stores the unvalidated input persistently on the device without proper sanitization or context-aware output encoding. Subsequently, when an administrative user or another authenticated victim navigates to the affected management interface pages, the web application retrieves the stored malicious payload and renders it directly into the Document Object Model (DOM) of the victim's browser without adequate neutralization.\nUpon rendering, the browser interprets the injected payload as legitimate application code, executing the arbitrary script in the context of the victim's authenticated session. This post-exploitation behavior enables the attacker to perform actions on behalf of the victim, access sensitive session tokens, manipulate interface functionality, or execute secondary attacks against the underlying web application architecture. The attack vector requires remote network connectivity to the device management interface, authentication with valid user credentials, and active interaction from a secondary user whose session processes the stored payload."
}