This script is (C) 2010-2016 Tenable Network Security, Inc.
The remote device is missing a vendor-supplied security patch.
A vulnerability exists in the IOS HTTP server in which HTML code
inserted into dynamically-generated output, such as the output from a
show buffers command, will be passed to the browser requesting the
page. This HTML code could be interpreted by the client browser and
potentially execute malicious commands against the device or execute
other possible cross-site scripting attacks. Successful exploitation
of this vulnerability requires that a user browse a page containing
dynamic content in which HTML commands have been injected.
Cisco will be making free software available to address this
vulnerability for affected customers. There are workarounds available
to mitigate the effects of the vulnerability.
See also :
Apply the relevant patch referenced in Cisco Security Advisory
Risk factor :
Medium / CVSS Base Score : 5.0
CVSS Temporal Score : 4.1
Public Exploit Available : true