CVE-2025-20374
Full vulnerability record from the local CVENow database.
Description
A vulnerability in the web UI of Cisco Unified CCX could allow an authenticated, remote attacker to perform a directory traversal and access arbitrary resources. This vulnerability is due to an insufficient input validation associated to specific UI features. An attacker could exploit this vulnerability by sending a crafted request to the web UI. A successful exploit could allow the attacker to gain read access to arbitrary files on the underlying operating system. To exploit this vulnerability, the attacker must have valid administrative credentials.
Severity
MEDIUM
CVSS score
4.9
(v3.1)
Vulnerability status
Analyzed
Source identifier
Published
2025-11-05 17:15:38.457000
Last modified
2026-10-18 21:10:00.120000
View original CVE JSON
{
"id": "CVE-2025-20374",
"sourceIdentifier": "[email protected]",
"published": "2025-11-05T17:15:38.457",
"lastModified": "2026-10-18T21:10:00.120",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in the web UI of Cisco Unified CCX could allow an authenticated, remote attacker to perform a directory traversal and access arbitrary resources.\r\n\r\nThis vulnerability is due to an insufficient input validation associated to specific UI features. An attacker could exploit this vulnerability by sending a crafted request to the web UI. A successful exploit could allow the attacker to gain read access to arbitrary files on the underlying operating system. To exploit this vulnerability, the attacker must have valid administrative credentials."
},
{
"lang": "es",
"value": "Una vulnerabilidad en la interfaz de usuario web de Cisco Unified CCX podría permitir a un atacante remoto autenticado realizar un salto de directorio y acceder a recursos arbitrarios.\n\nEsta vulnerabilidad se debe a una validación de entrada insuficiente asociada a características específicas de la interfaz de usuario. Un atacante podría explotar esta vulnerabilidad enviando una solicitud manipulada a la interfaz de usuario web. Un exploit exitoso podría permitir al atacante obtener acceso de lectura a archivos arbitrarios en el sistema operativo subyacente. Para explotar esta vulnerabilidad, el atacante debe tener credenciales administrativas válidas."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "Cisco",
"product": "Cisco Unified Contact Center Express",
"defaultStatus": "unknown",
"versions": [
{
"version": "10.5(1)SU1",
"status": "affected"
},
{
"version": "10.6(1)",
"status": "affected"
},
{
"version": "11.6(1)",
"status": "affected"
},
{
"version": "10.6(1)SU1",
"status": "affected"
},
{
"version": "10.6(1)SU3",
"status": "affected"
},
{
"version": "11.6(2)",
"status": "affected"
},
{
"version": "12.0(1)",
"status": "affected"
},
{
"version": "11.0(1)SU1",
"status": "affected"
},
{
"version": "11.5(1)SU1",
"status": "affected"
},
{
"version": "10.5(1)",
"status": "affected"
},
{
"version": "12.5(1)",
"status": "affected"
},
{
"version": "12.5(1)SU1",
"status": "affected"
},
{
"version": "12.5(1)SU2",
"status": "affected"
},
{
"version": "12.5(1)SU3",
"status": "affected"
},
{
"version": "12.5(1)_SU03_ES01",
"status": "affected"
},
{
"version": "12.5(1)_SU03_ES02",
"status": "affected"
},
{
"version": "12.5(1)_SU02_ES03",
"status": "affected"
},
{
"version": "12.5(1)_SU02_ES04",
"status": "affected"
},
{
"version": "12.5(1)_SU02_ES02",
"status": "affected"
},
{
"version": "12.5(1)_SU01_ES02",
"status": "affected"
},
{
"version": "12.5(1)_SU01_ES03",
"status": "affected"
},
{
"version": "12.5(1)_SU02_ES01",
"status": "affected"
},
{
"version": "11.6(2)ES07",
"status": "affected"
},
{
"version": "11.6(2)ES08",
"status": "affected"
},
{
"version": "12.5(1)_SU01_ES01",
"status": "affected"
},
{
"version": "12.0(1)ES04",
"status": "affected"
},
{
"version": "12.5(1)ES02",
"status": "affected"
},
{
"version": "12.5(1)ES03",
"status": "affected"
},
{
"version": "11.6(2)ES06",
"status": "affected"
},
{
"version": "12.5(1)ES01",
"status": "affected"
},
{
"version": "12.0(1)ES03",
"status": "affected"
},
{
"version": "12.0(1)ES01",
"status": "affected"
},
{
"version": "11.6(2)ES05",
"status": "affected"
},
{
"version": "12.0(1)ES02",
"status": "affected"
},
{
"version": "11.6(2)ES04",
"status": "affected"
},
{
"version": "11.6(2)ES03",
"status": "affected"
},
{
"version": "11.6(2)ES02",
"status": "affected"
},
{
"version": "11.6(2)ES01",
"status": "affected"
},
{
"version": "10.6(1)SU3ES03",
"status": "affected"
},
{
"version": "11.0(1)SU1ES03",
"status": "affected"
},
{
"version": "10.6(1)SU3ES01",
"status": "affected"
},
{
"version": "10.5(1)SU1ES10",
"status": "affected"
},
{
"version": "11.5(1)SU1ES03",
"status": "affected"
},
{
"version": "11.6(1)ES02",
"status": "affected"
},
{
"version": "11.5(1)ES01",
"status": "affected"
},
{
"version": "10.6(1)SU2",
"status": "affected"
},
{
"version": "10.6(1)SU2ES04",
"status": "affected"
},
{
"version": "11.6(1)ES01",
"status": "affected"
},
{
"version": "10.6(1)SU3ES02",
"status": "affected"
},
{
"version": "11.5(1)SU1ES02",
"status": "affected"
},
{
"version": "11.5(1)SU1ES01",
"status": "affected"
},
{
"version": "11.0(1)SU1ES02",
"status": "affected"
},
{
"version": "12.5(1)_SU03_ES03",
"status": "affected"
},
{
"version": "12.5(1)_SU03_ES04",
"status": "affected"
},
{
"version": "12.5(1)_SU03_ES05",
"status": "affected"
},
{
"version": "UCCX 15.0.1",
"status": "affected"
},
{
"version": "12.5(1)_SU03_ES06",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
"baseScore": 4.9,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "HIGH",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 1.2,
"impactScore": 3.6
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2025-11-05T20:10:38.672178Z",
"id": "CVE-2025-20374",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-22"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:cisco:unified_contact_center_express:*:*:*:*:*:*:*:*",
"versionEndExcluding": "12.5\\(1\\)_su03_es07",
"matchCriteriaId": "6EF18C21-6E70-4748-99FA-884754F44D1A"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:cisco:unified_contact_center_express:15.0:*:*:*:*:*:*:*",
"matchCriteriaId": "124C88AE-ED0C-4CBC-A84D-200EDB776C8C"
}
]
}
]
}
],
"references": [
{
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cc-mult-vuln-gK4TFXSn",
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
}
]
}