CVE-2025-20358

9.8

CRITICAL CVSS 3.1

Cisco Unified Contact Center Express Editor Authentication Bypass Vulnerability

Description

A vulnerability in the Contact Center Express (CCX) Editor application of Cisco Unified CCX could allow an unauthenticated, remote attacker to bypass authentication and obtain administrative permissions pertaining to script creation and execution. This vulnerability is due to improper authentication mechanisms in the communication between the CCX Editor and an affected Unified CCX server. An attacker could exploit this vulnerability by redirecting the authentication flow to a malicious server and tricking the CCX Editor into believing the authentication was successful. A successful exploit could allow the attacker to create and execute arbitrary scripts on the underlying operating system of an affected Unified CCX server, as an internal non-root user account.

INFO

Published Date :

Nov. 5, 2025, 5:15 p.m.

Last Modified :

Nov. 7, 2025, 3:43 p.m.

Remotely Exploit :

Yes !

Source :

[email protected]

Affected Products

The following products are affected by CVE-2025-20358 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID	Vendor	Product	Action
1	Cisco	unified_contact_center_express

: Total Affected Vendor : 1 | Products : 1

CVSS Scores

The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and displays CVSS scores from various sources for each CVE.

Score	Version	Severity	Vector	Exploitability Score	Impact Score	Source
	CVSS 3.1	CRITICAL				[email protected]
	CVSS 3.1	CRITICAL				[email protected]

Solution

Apply vendor-supplied security updates to address improper authentication.

Apply security updates from Cisco.
Monitor authentication logs for suspicious activity.

References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2025-20358.

URL	Resource
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cc-unauth-rce-QeN8h7mQ	Vendor Advisory

CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2025-20358 is associated with the following CWEs:

CWE-306: Missing Authentication for Critical Function

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2025-20358 weaknesses.

CAPEC-12: Choosing Message Identifier Choosing Message Identifier CAPEC-36: Using Unpublished Interfaces or Functionality Using Unpublished Interfaces or Functionality CAPEC-62: Cross Site Request Forgery Cross Site Request Forgery CAPEC-166: Force the System to Reset Values Force the System to Reset Values CAPEC-216: Communication Channel Manipulation Communication Channel Manipulation

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2025-20358 vulnerability anywhere in the article.

CybersecurityNews

Multiple vulnerabilities in Cisco Unified CCX Allow Attackers to Execute Arbitrary Commands

Cisco has released security updates to address two critical vulnerabilities in Unified Contact Center Express (Unified CCX) that could allow unauthenticated attackers to execute arbitrary commands wit ...

Published Date: Nov 14, 2025 (1 week, 6 days ago)

Help Net Security

Week in review: Cisco fixes critical UCCX flaws, November 2025 Patch Tuesday forecast

Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: Securing real-time payments without slowing them down In this Help Net Security interview, Arun Singh, ...

Published Date: Nov 09, 2025 (2 weeks, 5 days ago)

BleepingComputer

Cisco: Actively exploited firewall flaws now abused for DoS attacks

Cisco warned this week that two vulnerabilities, which have been used in zero-day attacks, are now being exploited to force ASA and FTD firewalls into reboot loops. The tech giant released security up ...

Published Date: Nov 07, 2025 (2 weeks, 6 days ago)

The Cyber Express

Cisco Issues Critical Warning Over New Unified Contact Center Express Vulnerabilities

Cisco has issued an urgent security advisory detailing two critical vulnerabilities affecting its Unified Contact Center Express (Unified CCX) platform. The flaws, identified as CVE-2025-20354 and CVE ...

Published Date: Nov 07, 2025 (2 weeks, 6 days ago)

TheCyberThrone

Cisco UCCX Vulnerabilities Alert

November 7, 2025Cisco Unified Contact Center Express (UCCX) recently came under scrutiny due to two critical vulnerabilities that pose serious risks to organizations relying on this platform for manag ...

Published Date: Nov 07, 2025 (3 weeks ago)

The Register

Cisco warns of 'new attack variant' battering firewalls under exploit for 6 months

Cisco warned customers about another wave of attacks against its firewalls, which have been battered by intruders for at least six months. It also patched two critical bugs in its Unified Contact Cent ...