CVE-2026-20175

6.1 MEDIUM

A vulnerability in Cisco Finesse could allow an unauthenticated, remote attacker to load arbitrary files from remote locations into an ac...

Published: 2026-06-03 · Last updated: 2026-06-04

Severity and scoring

CVSS: 6.1 MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CWE: CWE-73

Description

A vulnerability in Cisco Finesse could allow an unauthenticated, remote attacker to load arbitrary files from remote locations into an active user session on an affected device, possibly leading to browser-based attacks. This vulnerability is due to insufficient validation of user-supplied input for HTTP requests that are sent to an affected device. An attacker who has knowledge of the address of the affected device could exploit this vulnerability by persuading a user to click a crafted link that contains the affected device address. A successful exploit could allow the attacker to conduct browser-based attacks and execute arbitrary script code in the context of the affected interface or access sensitive information on the affected device.

Source: NVD

References

Related CVEs

Same CWE

CVE-2026-47643 — External control of file name or path in Azure Stack Edge allows an unauthorized attacker to execute code over a network (9.8 CRITICAL)
CVE-2025-12656 — The Migration, Backup, Staging – WPvivid Backup & Migration plugin for WordPress is vulnerable to arbitrary directory deletion due to ins... (3.8 LOW)
CVE-2026-46397 — HAX CMS helps manage microsite universe with PHP or NodeJs backends (6.5 MEDIUM)
CVE-2026-46399 — HAX CMS helps manage microsite universe with PHP or NodeJs backends
CVE-2026-40605 — Tautulli is a Python based monitoring and tracking tool for Plex Media Server