CVE-2017-6661: A vulnerability in the web-based management interface of Cisco Email Security Appliance (ESA) and Cisco Con...

Security readout for executives and security teams

This is an XSS flaw in the Cisco ESA and SMA web management interface. An unauthenticated remote attacker could cause script to run in a management user's browser. The provided sources do not include CVSS, confirmed exploitation, or detailed fix status. Exposure is limited to organizations running affected Cisco ESA or SMA versions with reachable web-based management interfaces. Business risk is higher where administrators access the interface from shared networks or where management access is not tightly restricted. Prioritize remediation for internet-reachable or broadly accessible management interfaces. The issue is not listed in KEV and has no supplied CVSS, but management-interface XSS can affect privileged administrative sessions. Mitigation focus: Review Cisco's advisory for fixed software and vendor-supported guidance.; Restrict access to ESA and SMA management interfaces to trusted administrative networks.; Inventory ESA and SMA versions, especially 10.0.0-203 and 10.1.0-049..

Prepared

Jun 13, 2026, 04:43 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.