What’s Vulnerable › Vulnerabilities

CVE-2020-3121: Cisco Small Business Smart and Managed Switches Cross-Site Scripting Vulnerability

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-01-26 · updated 2026-06-17
• Weakness: CWE-79

Description

A vulnerability in the web-based management interface of Cisco Small Business Smart and Managed Switches could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of the affected device. An attacker could exploit this vulnerability by persuading a user of the interface to click a malicious link and access a specific page. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.

Affected products

• Cisco Sf350-48 Firmware: through 2.5.0.90
• Cisco Sf350-48Mp Firmware: through 2.5.0.90
• Cisco Sf350-48P Firmware: through 2.5.0.90
• Cisco Sf550X-24 Firmware: through 2.5.0.90
• Cisco Sf550X-24P Firmware: through 2.5.0.90
• Cisco Sf550X-48 Firmware: through 2.5.0.90
• Cisco Sf550X-48Mp Firmware: through 2.5.0.90
• Cisco Sf550X-48P Firmware: through 2.5.0.90
• Cisco Sg250-08 Firmware: through 2.5.0.90
• Cisco Sg250-08Hp Firmware: through 2.5.0.90
• Cisco Sg250-10P Firmware: through 2.5.0.90
• Cisco Sg250-18 Firmware: through 2.5.0.90
• Cisco Sg250-24 Firmware: through 2.5.0.90
• Cisco Sg250-24P Firmware: through 2.5.0.90
• Cisco Sg250-26 Firmware: through 2.5.0.90
• Cisco Sg250-26Hp Firmware: through 2.5.0.90
• Cisco Sg250-26P Firmware: through 2.5.0.90
• Cisco Sg250-48 Firmware: through 2.5.0.90
• Cisco Sg250-48Hp Firmware: through 2.5.0.90
• Cisco Sg250-50 Firmware: through 2.5.0.90
• Cisco Sg250-50Hp Firmware: through 2.5.0.90
• Cisco Sg250-50P Firmware: through 2.5.0.90
• Cisco Sg250X-24 Firmware: through 2.5.0.90
• Cisco Sg250X-24P Firmware: through 2.5.0.90
• Cisco Sg250X-48 Firmware: through 2.5.0.90
• Cisco Sg250X-48P Firmware: through 2.5.0.90
• Cisco Sg350-10 Firmware: through 2.5.0.90
• Cisco Sg350-10Mp Firmware: through 2.5.0.90
• Cisco Sg350-10P Firmware: through 2.5.0.90
• Cisco Sg350-28 Firmware: through 2.5.0.90

References

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200122-sbsms-xss
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200122-sbsms-xss

Get alerted when CVE-2020-3121 or the next vulnerability affects your stack