CVE-2025-20361
MediumCVSS 4.8Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
XSS vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM) and Unified CM SME. An authenticated remote attacker can inject malicious code into specific pages, allowing script execution in the interface context or access to sensitive browser information.
Risk Assessment
An attacker with administrative credentials could hijack sessions of other users or steal sensitive data, potentially compromising the entire communication infrastructure.
Recommendation
Update Cisco Unified CM to the latest version and apply security patches provided by the vendor.
Other vulnerabilities in Cisco Unified Communications Manager
See all- CVE-2017-6791High
A vulnerability in the Trust Verification Service (TVS) of Cisco Unified Communications Manager could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to improper handling of Transport Layer Security (TLS) traffic by the affected software.
- CVE-2017-6757High
A vulnerability in Cisco Unified Communications Manager 10.5(2.10000.5), 11.0(1.10000.10), and 11.5(1.10000.6) allows an authenticated, remote attacker to conduct a blind SQL injection attack. The issue is due to a failure to validate user-supplied input used in SQL queries that bypass protection filters.
- CVE-2016-6364High
The User Data Services (UDS) API implementation in Cisco Unified Communications Manager 11.5 allows remote attackers to bypass intended access restrictions and obtain sensitive information via unspecified API calls.
- CVE-2026-20230HighActively exploited
A vulnerability in Cisco Unified Communications Manager and Unified CM SME allows an unauthenticated remote attacker to perform SSRF attacks. The attacker can write files to the OS, potentially leading to root privilege escalation. WebDialer service must be enabled (disabled by default).
Original NVD description (English source)
A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. This vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by injecting malicious code into specific pages of the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. To exploit this vulnerability, the attacker must have valid administrative credentials.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS