PT-2025-34894 · Cisco · Cisco Ucs Manager+1

Published 2025-08-27 · Updated 2025-09-22 · CVE-2025-20317

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:L/Au:N/C:C/I:P/A:N

Name of the Vulnerable Software and Affected Versions: Cisco Integrated Management Controller (IMC) (affected versions not specified)

Description: A vulnerability in the Virtual Keyboard Video Monitor (vKVM) connection handling could allow an unauthenticated, remote attacker to redirect a user to a malicious website. This issue is due to insufficient verification of vKVM endpoints. An attacker could exploit this by persuading a user to click a crafted link, potentially capturing user credentials. The affected vKVM client is also included in Cisco UCS Manager. This could lead to phishing and session hijacking.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

BDU:2025-15905

CVE-2025-20317

Affected Products

Cisco Integrated Management Controller

Cisco Ucs Manager

References · 10

• https://bdu.fstec.ru/vul/2025-15905 · Security Note
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ucs-vkvmorv-CnKrV7HK · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-20317 · Security Note
• https://twitter.com/CCBalert/status/1961058398675333273 · Twitter Post
• https://twitter.com/DavidMarquet19/status/1970020379725873663 · Twitter Post
• https://twitter.com/dailytechonx/status/1961205907062133173 · Twitter Post
• https://twitter.com/CVEnew/status/1960745852018024473 · Twitter Post
• https://twitter.com/0dayPublishing/status/1960756508125204578 · Twitter Post
• https://twitter.com/SystemTek_UK/status/1961136019274711190 · Twitter Post
• https://twitter.com/ZeroPathLabs/status/1960763221985440008 · Twitter Post