CVE-2025-20374
MediumCVSS 4.9Exploitation Probability (EPSS)
Elevated risk66th percentile - higher than 66% of all known CVEs
Summary
A vulnerability in the web UI of Cisco Unified CCX could allow an authenticated, remote attacker to perform a directory traversal and access arbitrary resources. The cause is insufficient input validation in specific UI features; exploitation requires valid administrative credentials.
Risk Assessment
An attacker with administrative privileges can gain read access to arbitrary files on the operating system, potentially exposing sensitive data and facilitating further attacks.
Recommendation
Apply Cisco security updates for Unified CCX and restrict administrative access to the web UI to trusted networks.
Other vulnerabilities in Cisco Unified CCX
See all- CVE-2025-20358Critical
A vulnerability in the Contact Center Express (CCX) Editor application of Cisco Unified CCX could allow an unauthenticated, remote attacker to bypass authentication and obtain administrative permissions for script creation and execution. This is due to improper authentication mechanisms in the communication between the CCX Editor and the Unified CCX server.
- CVE-2025-20354Critical
A vulnerability in the Java RMI process of Cisco Unified CCX is due to improper authentication mechanisms associated with specific features. An unauthenticated remote attacker could upload a crafted file and execute arbitrary commands with root privileges.
- CVE-2025-20376Medium
A vulnerability in the web UI of Cisco Unified CCX is due to insufficient input validation in file upload mechanisms. An authenticated remote attacker with administrative credentials can upload and execute a malicious file, leading to arbitrary command execution and privilege escalation to root.
- CVE-2025-20375Medium
A vulnerability in the web UI of Cisco Unified CCX could allow an authenticated, remote attacker to upload and execute arbitrary files. It is due to insufficient input validation in specific UI features. The attacker must have valid administrative credentials.
Original NVD description (English source)
A vulnerability in the web UI of Cisco Unified CCX could allow an authenticated, remote attacker to perform a directory traversal and access arbitrary resources. This vulnerability is due to an insufficient input validation associated to specific UI features. An attacker could exploit this vulnerability by sending a crafted request to the web UI. A successful exploit could allow the attacker to gain read access to arbitrary files on the underlying operating system. To exploit this vulnerability, the attacker must have valid administrative credentials.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS