Cisco Catalyst SD-WAN Manager Reflected HTML Injection (cisco-sa-vmanage-html-inj-GxVtK6zj)

#TRUSTED 6b500210f53fad2aa7755c502b45a34173b22e343048930f26d06cc44805aec0e124725c89ea175bc2b73f9fbacc2f2554ea1173f606a014e6ef8cc04cab68a060f0c09350756fa12ceec050133c77b5f3f25bd98dfe012ae01df5827681298878b3c45316c03ca16048849f123e890a036826559240f373c2cf4245fcf5ec289a47a210abf8f3cb5d3c6315634459aef6113045eba9daec20b660510beddc313b1e0da8cbf3a8b17e0a96b5026d966909e6150ed805e755a29a243579cd2bf3de739dc95969abe7d75e005101053dfd1de4db399133ccd60cc7df7773ad969d488ff075a79dcb136b19b822ef38bfde968663d4fce741089323a708128e92a376d3cd44842133448da7c66e6ae4d00f2442f7186ffe76870b2c2d5109797f38eb6326f563dccec1897022a14bd7533b59560965f4a07beaae9d79ea7c03cee37618e88eaaebe476ad3c2b2a6d2cb7d21667e9bd23335da0fb18f6c3f3039311a2c59b462c68a79bbd8acaa235b5252f4c8ef45182d139f854fa901b4232adc2fa8f8f5ee558c8633f719530d0dda61b9c48a90f064967396d0a4e00147029316ffab332c2a522ab1693ec2f94c505ba779a93e3f2d4859131b31ee78694665738f7053d88e222d798b7bcae6b94c4202a6b66d43276bd011a89e2606f624e997715d7a8d85f4e79c7657d976e8d770c8c6ec488b9ea7b7d9a1b4a98cd1ee17e
#TRUST-RSA-SHA256 44dd1e3b384df42b81e7377818263a954fc91e332ed2547bc44a3a605207e7ecf1ae5bc925325910c2dbc15a5cbeb084bc2980edc65537240f9e8220369f6d798d59ef4eb3e7d95d02c726ab83e1f239a6b8ecb6cb5b8db804d62be3ace395f3008f490d4156bfbb5feee6169809712d665cfb0bb85d3f0c38e94a542b922ce3115758ef677303228568f0d5411f52dd103c08295029d6e8143bef6daafa84cdb577abbf89d5ba9b548218d7dae151b5eb37114d8b313452c232996730acc5bf696669730352fe3dd5c331e7b165bc37a87d9c5d9e9d86c15e7d3a6fe83b3ca4b6d16f4ed0d3446365fc3d97c1282bdcdee31697c357b1963ed33723c17b8208b99b1b0f2f7009c4761aaacb8a3bd6e6cce43102256624544e3b249be0f27dd0de28f32e55fa0a0610bf06997115a43b3de1ef4eef38293a4c960a9742399efde74b204ffb1df93e904520970c8bf057734593899a889a6f39621b1d29d80962ef18b717aaf847bdc7ab211c06c4bcff1a2aad7d6864635580065c858208e29a8be919443fb7a2097edf7c76586aa7f61e6d6e2b1b1da96d630eacc381d942c0e0f0b7fdc46f825fffa142578ff38f4598b84175ed4a585a85f3dafd13656690a08baf162145f08a2788cfb1c47763fb9e936a87b5f8df8221fc436400dd4642f8a19b2ed3ea38101b74ee16a06ed3528bb441aef0062abfaf29428ad19ade75
#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(235490);
  script_version("1.4");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/01/21");

  script_cve_id("CVE-2025-20216");
  script_xref(name:"CISCO-BUG-ID", value:"CSCwk90639");
  script_xref(name:"CISCO-SA", value:"cisco-sa-vmanage-html-inj-GxVtK6zj");
  script_xref(name:"IAVA", value:"2025-A-0316-S");

  script_name(english:"Cisco Catalyst SD-WAN Manager Reflected HTML Injection (cisco-sa-vmanage-html-inj-GxVtK6zj)");

  script_set_attribute(attribute:"synopsis", value:
"The remote device is missing a vendor-supplied security patch");
  script_set_attribute(attribute:"description", value:
"According to its self-reported version, Cisco SD-WAN Viptela Software is affected by a vulnerability.

  - A vulnerability in the web interface of Cisco Catalyst SD-WAN Manager, formerly Cisco SD-WAN vManage,
    could allow an unauthenticated, remote attacker to inject HTML into the browser of an authenticated user.
    This vulnerability is due to improper sanitization of input to the web interface. An attacker could
    exploit this vulnerability by convincing an authenticated user to click a malicious link. A successful
    exploit could allow the attacker to inject HTML into the browser of an authenticated Cisco Catalyst SD-WAN
    Manager user. (CVE-2025-20216)

Please see the included Cisco BIDs and Cisco Security Advisory for more information.");
  # https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vmanage-html-inj-GxVtK6zj
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?916b21f8");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwk90639");
  script_set_attribute(attribute:"solution", value:
"Upgrade to the relevant fixed version referenced in Cisco bug ID CSCwk90639");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-20216");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(74);

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/05/07");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/05/07");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/05/07");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:sd-wan_firmware");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CISCO");

  script_copyright(english:"This script is Copyright (C) 2025-2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("cisco_vedge_detect.nbin");
  script_require_keys("Cisco/Viptela/Version");

  exit(0);
}

include('ccf.inc');

var product_info = cisco::get_product_info(name:'Cisco Viptela');

if ('vmanage' >!< tolower(product_info['model']))
  audit(AUDIT_HOST_NOT, 'an affected model');

var vuln_ranges = [
  { 'min_ver' : '0.0', 'fix_ver' : '20.9.7' },
  { 'min_ver' : '20.10', 'fix_ver' : '20.12.5' },
  { 'min_ver' : '20.13', 'fix_ver' : '20.15.2' }
];

 
var reporting = make_array(
  'port'     , 0,
  'severity' , SECURITY_WARNING,
  'bug_id'   , 'CSCwk90639',
  'version'  , product_info['version'],
  'disable_caveat', TRUE
);

cisco::check_and_report(
  product_info:product_info,
  vuln_ranges:vuln_ranges,
  reporting:reporting
);