PT-2025-22392 · Cisco · Cisco Unified Contact Center Enterprise

Published 2025-05-21 · Updated 2025-07-11 · CVE-2025-20242

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Cisco Unified Contact Center Enterprise (CCE) (affected versions not specified)

Description A vulnerability in the Cloud Connect component could allow an unauthenticated, remote attacker to read and modify data on an affected device due to a lack of proper authentication controls. An attacker could exploit this by sending crafted TCP data to a specific port on an affected device, potentially allowing them to read or modify data.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

BDU:2025-06732

CVE-2025-20242

Affected Products

Cisco Unified Contact Center Enterprise

References · 6

• https://osv.dev/vulnerability/CVE-2025-20242 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-20242 · Security Note
• https://bdu.fstec.ru/vul/2025-06732 · Security Note
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-contcent-insuffacces-ArDOVhN8 · Vendor Advisory
• https://t.me/cvenotify/128559 · Telegram Post
• https://twitter.com/CVEnew/status/1925238749933260922 · Twitter Post