PT-2025-23825 · Cisco · Cisco Unified Ccx

Published 2025-06-04 · Updated 2025-07-22 · CVE-2025-20277

Positive Technologies (AI Summary)

CVSS v3.1

6.7

Medium

Base vector

AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cisco Unified CCX (affected versions not specified)

Description A vulnerability in the web-based management interface could allow an authenticated, local attacker to execute arbitrary code on an affected device. The issue is due to improper limitation of a pathname to a restricted directory (path traversal). To exploit this, an attacker must have valid administrative credentials and could send a crafted web request to an affected device, followed by a specific command through an SSH session. A successful exploit could allow the attacker to execute arbitrary code on the underlying operating system as a low-privilege user and potentially undertake further actions to elevate their privileges to root.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2025-08668

CVE-2025-20277

Affected Products

Cisco Unified Ccx

References · 8

• https://osv.dev/vulnerability/CVE-2025-20277 · Vendor Advisory
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-uccx-multi-UhOTvPGL · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-20277 · Security Note
• https://bdu.fstec.ru/vul/2025-08668 · Security Note
• https://t.me/cvenotify/129812 · Telegram Post
• https://twitter.com/CVEnew/status/1930305583737123282 · Twitter Post
• https://t.me/cvetracker/25420 · Telegram Post
• https://t.me/cveNotify/129812 · Telegram Post