The vulnerability allows an authenticated remote attacker to store malicious script within the Cisco IOS XE web‑based IOx management interface. The injected code runs in the context of the victim’s browser session, allowing the attacker to hijack the session, exfiltrate confidential information, or otherwise interfere with the interface’s operation. This stored XSS results from insufficient validation of user input submitted to specific pages of the interface.

Cisco IOS XE Software, the web‑based IOx application hosting environment management interface. No specific minor versions were listed, so all releases that include the affected interface are potentially vulnerable.

The CVSS score of 4.8 indicates a medium severity, and the vulnerability is not listed in the KEV catalog. Because exploitation requires valid administrative credentials, the attack surface is limited to users who can authenticate to the device’s web interface. The remote nature of the interface and lack of additional safeguards mean that once authenticated, an attacker can inject code easily; however, the absence of an EPSS score suggests limited known exploitation activity. Overall, the risk remains moderate, with likely exploitability for attackers who have compromised credentials or otherwise obtained privileged access.