Cisco Industrial Ethernet 1000 Series Switches Stored Cross-Site Scripting Vulnerability

mediumCVE-2026-20232

A vulnerability in the web-based management interface of Cisco Industrial Ethernet (IE) 1000 Series Switches could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface. This vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected system. An attacker could exploit this vulnerability by injecting malicious code into specific pages of the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of another user. To exploit this vulnerability, the attacker must have valid user credentials on the affected system. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ie1k-NgXUFF52 Security Impact Rating: Medium CVE: CVE-2026-20232

CSIRTS triage

vendor: Cisco product: Industrial Ethernet 1000 Series Switches Cross-site scripting

What: Stored cross-site scripting in the web-based management interface allows authenticated attackers to inject malicious code.
Who is affected: Authenticated users of Cisco IE 1000 Series Switches web interface are affected.
Urgency: Medium urgency; requires valid credentials but allows arbitrary script execution in other users' sessions.
Action: Apply Cisco software updates for Industrial Ethernet 1000 Series Switches.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch Industrial Ethernet 1000 Series Switches

Get an email when a new Industrial Ethernet 1000 Series Switches advisory drops — max one per day, one-click unsubscribe.

Details

Source: Cisco Security Advisories (INTL · vendor-psirt · site)
Severity: medium
Published: 2026-08-19
Exploitation: Not in CISA KEV at last sync

Original advisory: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ie1k-NgXUFF52?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20Industrial%20Ethernet%201000%20Series%20Switches%20Stored%20Cross-Site%20Scripting%20Vulnerability%26vs_k=1

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-202320.21% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 11% of all EPSS-scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-20232	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

Recent advisories for Cisco Industrial Ethernet

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

medium[NEW] [medium] Cisco Industrial Ethernet 1000 Series Switches: Multiple vulnerabilitiescert-bund · 2026-08-20
mediumCVE-2026-20232: A vulnerability in the web-based management interface of Cisco Industrial Ethernet (IE) 1000 S…nvd · 2026-08-19
mediumCVE-2026-20177: A vulnerability in the handling of management plane packets by Cisco Industrial Ethernet (IE) …nvd · 2026-08-19
highCisco Industrial Ethernet 1000 Series Switches Denial of Service Vulnerabilitycisco-psirt · 2026-08-19
criticalexploitedCVE-2017-12235: Cisco IOS Software for Cisco Industrial Ethernet Switches PROFINET Denial-of-Service Vulnerabi…cisa-kev · 2022-03-03