CVE-2025-20310Network attack vector

Stored script execution via disabled rich-text policy

Published Jul 2, 2025 · Updated Jul 2, 2025

Stored XSS in Cisco Enterprise Chat and Email allows remote authenticated users to execute scripts after a user opens a crafted link. When the inbound email rich-text security policy is disabled, the web UI stores user-supplied content without proper validation and renders it in an affected user's browser. Exploitation requires valid agent credentials and user interaction; successful execution can alter displayed content or expose browser-based information.

CVSS severity6.1
Medium
EPSS probability0.25%
Next 30 days · Sep 16, 2026
Known exploitationUnconfirmed
Based on sourced intelligence
Hinoki checkNot available
Coverage for this vulnerability

See if you're affected

Explore vulnerability checks for your environment with Hinoki.

Book a demo

Summary

What happened

Stored XSS in Cisco Enterprise Chat and Email allows remote authenticated users to execute scripts after a user opens a crafted link. When the inbound email rich-text security policy is disabled, the web UI stores user-supplied content without proper validation and renders it in an affected user's browser. Exploitation requires valid agent credentials and user interaction; successful execution can alter displayed content or expose browser-based information.

The record

CVE
CVE-2025-20310
Published
Jul 2, 2025
Updated
Jul 2, 2025
Vendor
ClamAV
Product
Cisco Enterprise Chat and Email
Classifications
CWE-79, T1189
Attack vector
network
Privileges
authenticated

Timeline

How it unfolded

  1. Jul 2, 2025CVE publishedPublication date reported by the CVE source.
  2. Jul 2, 2025Record updatedLatest update available in the CVE record.

Exploitability

Present is not the same as exploitable

Compare your product and version with the public record. A matching version still requires validation against your environment.

Is a vulnerable build present?

Compare these published version ranges with your installed build and any vendor patches.

  1. Affected versionversion=11.5(1)
  2. Affected versionversion=11.5(1)_ES1
  3. Affected versionversion=11.5(1)_ES1_ET1
  4. Affected versionversion=11.6(1)
  5. Affected versionversion=11.6(1)_ES1
  6. Affected versionversion=11.6(1)_ES10
  7. Affected versionversion=11.6(1)_ES11
  8. Affected versionversion=11.6(1)_ES12
  9. Affected versionversion=11.6(1)_ES12_ET1
  10. Affected versionversion=11.6(1)_ES2
  11. Affected versionversion=11.6(1)_ES3
  12. Affected versionversion=11.6(1)_ES4
  13. Affected versionversion=11.6(1)_ES5
  14. Affected versionversion=11.6(1)_ES6
  15. Affected versionversion=11.6(1)_ES6_ET1
  16. Affected versionversion=11.6(1)_ES7
  17. Affected versionversion=11.6(1)_ES8
  18. Affected versionversion=11.6(1)_ES8_ET1
  19. Affected versionversion=11.6(1)_ES9
  20. Affected versionversion=11.6(1)_ES9a
  21. Affected versionversion=12.0(1)
  22. Affected versionversion=12.0(1)_ES1
  23. Affected versionversion=12.0(1)_ES2
  24. Affected versionversion=12.0(1)_ES3
  25. Affected versionversion=12.0(1)_ES4
  26. Affected versionversion=12.0(1)_ES5
  27. Affected versionversion=12.0(1)_ES5a
  28. Affected versionversion=12.0(1)_ES6
  29. Affected versionversion=12.0(1)_ES6_ET1
  30. Affected versionversion=12.0(1)_ES6_ET2
  31. Affected versionversion=12.0(1)_ES6_ET3
  32. Affected versionversion=12.0(1)_ES7
  33. Affected versionversion=12.0(1)_ES7_ET1
  34. Affected versionversion=12.5(1)
  35. Affected versionversion=12.5(1)_ES1
  36. Affected versionversion=12.5(1)_ES2
  37. Affected versionversion=12.5(1)_ES3
  38. Affected versionversion=12.5(1)_ES3_ET1
  39. Affected versionversion=12.5(1)_ES3_ET2
  40. Affected versionversion=12.5(1)_ES3_ET3
  41. Affected versionversion=12.5(1)_ES4
  42. Affected versionversion=12.5(1)_ES4_ET1
  43. Affected versionversion=12.5(1)_ES4_ET2
  44. Affected versionversion=12.5(1)_ES5
  45. Affected versionversion=12.5(1)_ES5_ET1
  46. Affected versionversion=12.5(1)_ES5_ET2
  47. Affected versionversion=12.5(1)_ES6
  48. Affected versionversion=12.5(1)_ES6_ET1
  49. Affected versionversion=12.5(1)_ES7
  50. Affected versionversion=12.5(1)_ES7_ET1
  51. Affected versionversion=12.5(1)_ES8
  52. Affected versionversion=12.5(1)_ES8_ET1
  53. Affected versionversion=12.5(1)_ES9
  54. Affected versionversion=12.5(1)_ET1
  55. Affected versionversion=12.6(1)
  56. Affected versionversion=12.6(1)_ES1
  57. Affected versionversion=12.6(1)_ES10
  58. Affected versionversion=12.6(1)_ES10_ET1
  59. Affected versionversion=12.6(1)_ES1_ET1
  60. Affected versionversion=12.6(1)_ES1_ET2
  61. Affected versionversion=12.6(1)_ES2
  62. Affected versionversion=12.6(1)_ES2_ET5
  63. Affected versionversion=12.6(1)_ES3
  64. Affected versionversion=12.6(1)_ES3_ET3
  65. Affected versionversion=12.6(1)_ES4
  66. Affected versionversion=12.6(1)_ES4_ET1
  67. Affected versionversion=12.6(1)_ES4_ET2
  68. Affected versionversion=12.6(1)_ES5
  69. Affected versionversion=12.6(1)_ES5_ET1
  70. Affected versionversion=12.6(1)_ES5_ET2
  71. Affected versionversion=12.6(1)_ES5_ET3
  72. Affected versionversion=12.6(1)_ES6
  73. Affected versionversion=12.6(1)_ES6_ET1
  74. Affected versionversion=12.6(1)_ES6_ET2
  75. Affected versionversion=12.6(1)_ES6_ET3
  76. Affected versionversion=12.6(1)_ES7
  77. Affected versionversion=12.6(1)_ES7_ET1
  78. Affected versionversion=12.6(1)_ES8
  79. Affected versionversion=12.6(1)_ES8_ET1
  80. Affected versionversion=12.6(1)_ES8_ET2
  81. Affected versionversion=12.6(1)_ES9
  82. Affected versionversion=12.6(1)_ES9_ET1
  83. Affected versionversion=12.6(1)_ES9_ET2
  84. Affected versionversion=12.6(1)_ES9_ET3
  85. Affected versionversion=12.6(1)_ET1
  86. Affected versionversion=12.6(1)_ET2
  87. Affected versionversion=12.6(1)_ET3
  88. Affected versionversion=12.6_ES2_ET1
  89. Affected versionversion=12.6_ES2_ET2
  90. Affected versionversion=12.6_ES2_ET3
  91. Affected versionversion=12.6_ES2_ET4
  92. Affected versionversion=12.6_ES3_ET1
  93. Affected versionversion=12.6_ES3_ET2

What conditions does exploitation require?

Attack vectornetwork
Required privilegesauthenticated

What is affected?

ClamAV · Cisco Enterprise Chat and Emailversion=11.5(1); version=11.5(1)_ES1; version=11.5(1)_ES1_ET1; version=11.6(1); version=11.6(1)_ES1; version=11.6(1)_ES10; version=11.6(1)_ES11; version=11.6(1)_ES12; version=11.6(1)_ES12_ET1; version=11.6(1)_ES2; version=11.6(1)_ES3; version=11.6(1)_ES4; version=11.6(1)_ES5; version=11.6(1)_ES6; version=11.6(1)_ES6_ET1; version=11.6(1)_ES7; version=11.6(1)_ES8; version=11.6(1)_ES8_ET1; version=11.6(1)_ES9; version=11.6(1)_ES9a; version=12.0(1); version=12.0(1)_ES1; version=12.0(1)_ES2; version=12.0(1)_ES3; version=12.0(1)_ES4; version=12.0(1)_ES5; version=12.0(1)_ES5a; version=12.0(1)_ES6; version=12.0(1)_ES6_ET1; version=12.0(1)_ES6_ET2; version=12.0(1)_ES6_ET3; version=12.0(1)_ES7; version=12.0(1)_ES7_ET1; version=12.5(1); version=12.5(1)_ES1; version=12.5(1)_ES2; version=12.5(1)_ES3; version=12.5(1)_ES3_ET1; version=12.5(1)_ES3_ET2; version=12.5(1)_ES3_ET3; version=12.5(1)_ES4; version=12.5(1)_ES4_ET1; version=12.5(1)_ES4_ET2; version=12.5(1)_ES5; version=12.5(1)_ES5_ET1; version=12.5(1)_ES5_ET2; version=12.5(1)_ES6; version=12.5(1)_ES6_ET1; version=12.5(1)_ES7; version=12.5(1)_ES7_ET1; version=12.5(1)_ES8; version=12.5(1)_ES8_ET1; version=12.5(1)_ES9; version=12.5(1)_ET1; version=12.6(1); version=12.6(1)_ES1; version=12.6(1)_ES10; version=12.6(1)_ES10_ET1; version=12.6(1)_ES1_ET1; version=12.6(1)_ES1_ET2; version=12.6(1)_ES2; version=12.6(1)_ES2_ET5; version=12.6(1)_ES3; version=12.6(1)_ES3_ET3; version=12.6(1)_ES4; version=12.6(1)_ES4_ET1; version=12.6(1)_ES4_ET2; version=12.6(1)_ES5; version=12.6(1)_ES5_ET1; version=12.6(1)_ES5_ET2; version=12.6(1)_ES5_ET3; version=12.6(1)_ES6; version=12.6(1)_ES6_ET1; version=12.6(1)_ES6_ET2; version=12.6(1)_ES6_ET3; version=12.6(1)_ES7; version=12.6(1)_ES7_ET1; version=12.6(1)_ES8; version=12.6(1)_ES8_ET1; version=12.6(1)_ES8_ET2; version=12.6(1)_ES9; version=12.6(1)_ES9_ET1; version=12.6(1)_ES9_ET2; version=12.6(1)_ES9_ET3; version=12.6(1)_ET1; version=12.6(1)_ET2; version=12.6(1)_ET3; version=12.6_ES2_ET1; version=12.6_ES2_ET2; version=12.6_ES2_ET3; version=12.6_ES2_ET4; version=12.6_ES3_ET1; version=12.6_ES3_ET2

Published CVSS scores

6.1Cisco Systems, Inc.CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CVSS describes severity. EPSS estimates exploitation probability.

Attacks

What attackers are doing with it

Daily unique IPs observed by Shadowserver honeypots for known exploited vulnerabilities (KEVs). Missing observations do not establish an absence of attacks.

Daily unique IPsNo honeypot observations are available for this CVE in the selected window.

No observations available

Sep 10, 2026Sep 16, 2026
Latest reporting daySep 16, 2026
Latest daily unique IPsUnavailable
Prior 30-day averageUnavailable
SourceShadowserver honeypots (KEV)
Vectornetwork
Privilegesauthenticated
Known exploitationUnconfirmed
Public exploitUnconfirmed

Weakness, pattern, technique

CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
T1189Drive-by Compromise

Public exploit references

No public exploit references are available in this record.

Labels summarize the accepted research assessment. They do not indicate a test against your environment.

Technologies

Your stack

See the directory against your own environment.

Your stack

Check the software in your environment

Book a demo to see how Hinoki identifies affected software and validates exploitability in your environment.

Book a demo