CVE-2019-12718: Cisco Small Business Smart and Managed Switches Cross-Site Scripting Vulnerability

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-10-16 · updated 2026-06-17
Weakness: CWE-79

Description

A vulnerability in the web-based interface of Cisco Small Business Smart and Managed Switches could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based interface. The vulnerability is due to insufficient validation of user-supplied input by the web-based interface of the affected device. An attacker could exploit this vulnerability by persuading a user of the interface to click a malicious link and subsequently access a specific web interface page. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive browser-based information.

Affected products

Cisco Sf200-24 Firmware: before 1.4.11 — fixed in 1.4.11
Cisco Sf200-24Fp Firmware: before 1.4.11 — fixed in 1.4.11
Cisco Sf200-24P Firmware: before 1.4.11 — fixed in 1.4.11
Cisco Sf200-48 Firmware: before 1.4.11 — fixed in 1.4.11
Cisco Sf200-48P Firmware: before 1.4.11 — fixed in 1.4.11
Cisco Sf200E-24 Firmware: before 1.4.11 — fixed in 1.4.11
Cisco Sf200E-24P Firmware: before 1.4.11 — fixed in 1.4.11
Cisco Sf200E-48 Firmware: before 1.4.11 — fixed in 1.4.11
Cisco Sf200E48P Firmware: before 1.4.11 — fixed in 1.4.11
Cisco Sf250-08 Firmware: before 2.5.0.90 — fixed in 2.5.0.90
Cisco Sf250-08Hp Firmware: before 2.5.0.90 — fixed in 2.5.0.90
Cisco Sf250-10P Firmware: before 2.5.0.90 — fixed in 2.5.0.90
Cisco Sf250-18 Firmware: before 2.5.0.90 — fixed in 2.5.0.90
Cisco Sf250-24 Firmware: before 2.5.0.90 — fixed in 2.5.0.90
Cisco Sf250-24P Firmware: before 2.5.0.90 — fixed in 2.5.0.90
Cisco Sf250-26 Firmware: before 2.5.0.90 — fixed in 2.5.0.90
Cisco Sf250-26Hp Firmware: before 2.5.0.90 — fixed in 2.5.0.90
Cisco Sf250-26P Firmware: before 2.5.0.90 — fixed in 2.5.0.90
Cisco Sf250-48 Firmware: before 2.5.0.90 — fixed in 2.5.0.90
Cisco Sf250-48Hp Firmware: before 2.5.0.90 — fixed in 2.5.0.90
Cisco Sf250-50 Firmware: before 2.5.0.90 — fixed in 2.5.0.90
Cisco Sf250-50Hp Firmware: before 2.5.0.90 — fixed in 2.5.0.90
Cisco Sf250-50P Firmware: before 2.5.0.90 — fixed in 2.5.0.90
Cisco Sf250X-24 Firmware: before 2.5.0.90 — fixed in 2.5.0.90
Cisco Sf250X-24P Firmware: before 2.5.0.90 — fixed in 2.5.0.90
Cisco Sf250X-48 Firmware: before 2.5.0.90 — fixed in 2.5.0.90
Cisco Sf250X-48P Firmware: before 2.5.0.90 — fixed in 2.5.0.90
Cisco Sf300-08 Firmware: before 1.4.11 — fixed in 1.4.11
Cisco Sf300-24 Firmware: before 1.4.11 — fixed in 1.4.11
Cisco Sf300-24Mp Firmware: before 1.4.11 — fixed in 1.4.11

How to fix

Upgrade to a fixed version: Cisco Sf200-24 Firmware 1.4.11; Cisco Sf200-24Fp Firmware 1.4.11; Cisco Sf200-24P Firmware 1.4.11; Cisco Sf200-48 Firmware 1.4.11; Cisco Sf200-48P Firmware 1.4.11; Cisco Sf200E-24 Firmware 1.4.11; Cisco Sf200E-24P Firmware 1.4.11; Cisco Sf200E-48 Firmware 1.4.11; Cisco Sf200E48P Firmware 1.4.11; Cisco Sf250-08 Firmware 2.5.0.90; Cisco Sf250-08Hp Firmware 2.5.0.90; Cisco Sf250-10P Firmware 2.5.0.90. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2019-12718 or the next vulnerability affects your stack