CVE-2025-20358
BaseFortify
Publication date: 2025-11-05
Last updated on: 2025-11-07
Assigner: Cisco Systems, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| cisco | unified_contact_center_express | to 12.5\(1\)_su03_es07 (exc) |
| cisco | unified_contact_center_express | 15.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-306 | The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Cisco Unified Contact Center Express (CCX) Editor application, where an unauthenticated remote attacker can bypass authentication due to improper authentication mechanisms between the CCX Editor and the Unified CCX server. The attacker can redirect the authentication flow to a malicious server, tricking the CCX Editor into granting administrative permissions. This allows the attacker to create and execute arbitrary scripts on the affected server as an internal non-root user.
How can this vulnerability impact me? :
Exploiting this vulnerability could allow an attacker to gain administrative permissions on the affected Cisco Unified CCX server without authentication. The attacker could create and execute arbitrary scripts on the server, potentially leading to unauthorized access, manipulation of data, disruption of services, and other malicious activities impacting the confidentiality, integrity, and availability of the system.