CVE-2025-20358
CriticalCVSS 9.4Exploitation Probability (EPSS)
Elevated risk60th percentile - higher than 60% of all known CVEs
Summary
A vulnerability in the Contact Center Express (CCX) Editor application of Cisco Unified CCX could allow an unauthenticated, remote attacker to bypass authentication and obtain administrative permissions for script creation and execution. This is due to improper authentication mechanisms in the communication between the CCX Editor and the Unified CCX server.
Risk Assessment
An attacker could redirect the authentication flow to a malicious server and create and execute arbitrary scripts on the underlying operating system of the Unified CCX server as an internal non-root user.
Recommendation
Apply the patches provided by Cisco for Cisco Unified CCX. Restrict network access to the Unified CCX server and monitor for unusual activity.
Other vulnerabilities in Cisco Unified CCX
Original NVD description (English source)
A vulnerability in the Contact Center Express (CCX) Editor application of Cisco Unified CCX could allow an unauthenticated, remote attacker to bypass authentication and obtain administrative permissions pertaining to script creation and execution. This vulnerability is due to improper authentication mechanisms in the communication between the CCX Editor and an affected Unified CCX server. An attacker could exploit this vulnerability by redirecting the authentication flow to a malicious server and tricking the CCX Editor into believing the authentication was successful. A successful exploit could allow the attacker to create and execute arbitrary scripts on the underlying operating system of an affected Unified CCX server, as an internal non-root user account.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS