CVE-2025-20376
BaseFortify
Publication date: 2025-11-05
Last updated on: 2025-11-17
Assigner: Cisco Systems, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| cisco | unified_contact_center_express | to 12.5\(1\)_su03_es07 (exc) |
| cisco | unified_contact_center_express | 15.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-434 | The product allows the upload or transfer of dangerous file types that are automatically processed within its environment. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the web UI of Cisco Unified CCX and allows an authenticated remote attacker to upload and execute arbitrary files due to insufficient input validation in the file upload mechanism. By exploiting this, an attacker with valid administrative credentials can execute arbitrary commands on the system and gain root privileges.
How can this vulnerability impact me? :
If exploited, this vulnerability could allow an attacker to execute arbitrary commands on the affected system with root privileges, potentially leading to full system compromise, unauthorized access, and control over the Cisco Unified CCX environment.