CVE-2025-20354
BaseFortify
Publication date: 2025-11-05
Last updated on: 2025-11-07
Assigner: Cisco Systems, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| cisco | unified_contact_center_express | to 12.5\(1\)_su03_es07 (exc) |
| cisco | unified_contact_center_express | 15.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-434 | The product allows the upload or transfer of dangerous file types that are automatically processed within its environment. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Java Remote Method Invocation (RMI) process of Cisco Unified CCX. It allows an unauthenticated remote attacker to upload arbitrary files and execute arbitrary commands with root permissions on the affected system. The root cause is improper authentication mechanisms related to specific Cisco Unified CCX features, enabling the attacker to exploit the system by uploading a crafted file through the Java RMI process and gaining full control.
How can this vulnerability impact me? :
If exploited, this vulnerability can allow an attacker to execute arbitrary commands on the underlying operating system with root privileges. This means the attacker can take full control of the affected system, potentially leading to data theft, system disruption, unauthorized access, and further compromise of network resources.