CVE-2025-20277Low· 3.4▾ SunlitA vulnerability in the web-based management interface of Cisco Unified CCX could allow an authenticated, local attacker to execute arbitrary code on an affected device. To exploit this vulnerability, the attacker must have valid administ…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 18.7 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.2%
A vulnerability in the web-based management interface of Cisco Unified CCX could allow an authenticated, local attacker to execute arbitrary code on an affected device. To exploit this vulnerability, the attacker must have valid administrative credentials.
This vulnerability is due to improper limitation of a pathname to a restricted directory (path traversal). An attacker could exploit this vulnerability by sending a crafted web request to an affected device, followed by a specific command through an SSH session. A successful exploit could allow the attacker to execute arbitrary code on the underlying operating system of an affected device as a low-privilege user. A successful exploit could also allow the attacker to undertake further actions to elevate their privileges to root.
unified_contact_center_express 10.6(1)unified_contact_center_express 10.5(1)SU1unified_contact_center_express 10.6(1)SU3unified_contact_center_express 12.0(1)unified_contact_center_express 10.0(1)SU1unified_contact_center_express 10.6(1)SU1unified_contact_center_express 11.0(1)SU1unified_contact_center_express 11.5(1)SU1unified_contact_center_express 10.5(1)unified_contact_center_express 11.6(1)unified_contact_center_express 11.6(2)unified_contact_center_express 12.5(1)unified_contact_center_express 12.5(1)SU1unified_contact_center_express 12.5(1)SU2unified_contact_center_express 12.5(1)SU3unified_contact_center_express 12.5(1)_SU03_ES01unified_contact_center_express 12.5(1)_SU03_ES02unified_contact_center_express 12.5(1)_SU02_ES03unified_contact_center_express 12.5(1)_SU02_ES04unified_contact_center_express 12.5(1)_SU02_ES02unified_contact_center_express 12.5(1)_SU01_ES02unified_contact_center_express 12.5(1)_SU01_ES03unified_contact_center_express 12.5(1)_SU02_ES01unified_contact_center_express 11.6(2)ES07unified_contact_center_express 11.6(2)ES08unified_contact_center_express 12.5(1)_SU01_ES01unified_contact_center_express 12.0(1)ES04unified_contact_center_express 12.5(1)ES02unified_contact_center_express 12.5(1)ES03unified_contact_center_express 11.6(2)ES06unified_contact_center_express 12.5(1)ES01unified_contact_center_express 12.0(1)ES03unified_contact_center_express 12.0(1)ES01unified_contact_center_express 11.6(2)ES05unified_contact_center_express 12.0(1)ES02unified_contact_center_express 11.6(2)ES04unified_contact_center_express 11.6(2)ES03unified_contact_center_express 11.6(2)ES02unified_contact_center_express 11.6(2)ES01unified_contact_center_express 10.6(1)SU3ES03unified_contact_center_express 11.0(1)SU1ES03unified_contact_center_express 10.6(1)SU3ES01unified_contact_center_express 10.5(1)SU1ES10unified_contact_center_express 10.0(1)SU1ES04unified_contact_center_express 11.5(1)SU1ES03unified_contact_center_express 11.6(1)ES02unified_contact_center_express 11.5(1)ES01unified_contact_center_express 9.0(2)SU3ES04unified_contact_center_express 10.6(1)SU2unified_contact_center_express 10.6(1)SU2ES04Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2020-3365Medium· 4.3A vulnerability in the directory permissions of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, remote attacker to perform a directory traversal attack on a limited set of restricted directories
CVE-2020-3236Medium· 6.7A vulnerability in the CLI of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, local attacker to gain root shell access to the underlying operating system and overwrite or read arbitrary files
CVE-2020-3550High· 8.1A vulnerability in the sfmgr daemon of Cisco Firepower Management Center (FMC) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, remote attacker to perform directory traversal and access directories…
CVE-2020-3187Critical· 9.1A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct directory traversal attacks an…
CVE-2026-76506High· 7.6Cisco Unified Computing System Central Remote Code Execution Vulnerability
CVE-2025-20376Medium· 6.5Cisco Unified Contact Center Express Remote Code Execution Vulnerability