Executive brief
Cisco Prime Infrastructure, a platform used for managing network devices and wireless access, contains a security flaw in its web management interface. An attacker with administrative privileges could inject malicious scripts that execute when other users access the system. This could lead to the theft of sensitive browser-based information or unauthorized actions performed on behalf of other administrators.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in the web-based management interface of Cisco Prime Infrastructure due to insufficient validation of user-supplied input. An authenticated, remote attacker with administrative privileges can exploit this by inserting malicious code into specific data fields within the interface. When another user views the affected page, the malicious script executes in the context of their browser session. This can result in the disclosure of sensitive browser-based information or the execution of arbitrary actions. The vulnerability is addressed in Cisco Prime Infrastructure 3.10.6 Security Update 02; users on version 3.9 or earlier are advised to migrate to a fixed release.
Affected products
- Cisco Prime Infrastructure All versions prior to 3.10.6 Security Update 02
Timeline
- 2026-02-04: advisory: Initial public release by Cisco
- 2026-02-04: disclosed