A flaw in Cisco Catalyst SD‑WAN Manager’s web‑based management interface lets a remote attacker, who is authenticated to the interface, inject malicious JavaScript because user input is not properly validated. The attacker can persuade a legitimate user to click a crafted link, which then loads and runs arbitrary script code within the user’s browser session. The result is the ability to execute code in the context of the web interface or steal sensitive browser‑based information, a classic reflected XSS vulnerability (CWE‑79).

The vulnerable product is the Cisco Catalyst SD‑WAN Manager management interface. No specific version numbers are supplied, so any deployment that has not applied the vendor’s fix remains at risk. The attack requires authentication to the web interface and a user who interacts with a maliciously constructed URL.

The base CVSS score of 5.4 indicates moderate severity; the vector is remote with an authenticated user and requires user interaction. EPSS data is not available, and the flaw is not listed in the CISA KEV catalog, suggesting a lower likelihood of widespread exploitation. Nevertheless, any authenticated user exposed to phishing or social‑engineering links could fall victim, making the risk significant for organizations that grant broad web‑interface access.