PT-2025-23823 · Cisco · Cisco Unified Ccx Editor

Antonin B · Published 2025-06-04 · Updated 2025-07-22 · CVE-2025-20275

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cisco Unified Contact Center Express (Unified CCX) Editor (affected versions not specified)

Description The issue is related to insecure deserialization of Java objects by the affected software. An attacker could exploit this by persuading an authenticated, local user to open a crafted .aef file, potentially allowing the execution of arbitrary code on the host with the privileges of the user who launched the editor application.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

BDU:2025-08242

CVE-2025-20275

Affected Products

Cisco Unified Ccx Editor

References · 8

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-uccx-editor-rce-ezyYZte8 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-08242 · Security Note
• https://osv.dev/vulnerability/CVE-2025-20275 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-20275 · Security Note
• https://t.me/cvenotify/129810 · Telegram Post
• https://twitter.com/CVEnew/status/1930305585511313829 · Twitter Post
• https://t.me/cvetracker/25418 · Telegram Post
• https://t.me/cveNotify/129810 · Telegram Post