Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

CVE-2025-20317— Cisco UCS Virtual Keyboard Video Monitor (vKVM) Open Redirect Vulnerability

CVSS 7.1 · High EPSS 0.04% · P11
Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2025-20317

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Cisco UCS Virtual Keyboard Video Monitor (vKVM) Open Redirect Vulnerability
Source: NVD (National Vulnerability Database)
Vulnerability Description
A vulnerability in the Virtual Keyboard Video Monitor (vKVM) connection handling of Cisco Integrated Management Controller (IMC) could allow an unauthenticated, remote attacker to redirect a user to a malicious website. This vulnerability is due to insufficient verification of vKVM endpoints. An attacker could exploit this vulnerability by persuading a user to click a crafted link. A successful exploit could allow the attacker to redirect a user to a malicious webpage and potentially capture user credentials. Note: The affected vKVM client is also included in Cisco UCS Manager.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
指向未可信站点的URL重定向(开放重定向)
Source: NVD (National Vulnerability Database)
Vulnerability Title
Cisco Integrated Management Controller 输入验证错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Cisco Integrated Management Controller（IMC）是美国思科（Cisco）公司的一套用于对UCS（统一计算系统）进行管理的软件。该软件支持HTTP、SSH访问等，并可对服务器进行开机、关机和重启等操作。 Cisco Integrated Management Controller存在输入验证错误漏洞，该漏洞源于vKVM端点验证不足，可能导致重定向攻击。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

VendorProductAffected VersionsCPESubscribe
CiscoCisco Unified Computing System (Managed) 4.0(1a) -
CiscoCisco Unified Computing System (Standalone) 2.0(1a) -
CiscoCisco Unified Computing System E-Series Software (UCSE) 3.2.7 -

II. Public POCs for CVE-2025-20317

#POC DescriptionSource LinkShenlong Link
AI-Generated POCPremium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2025-20317

请登录查看更多情报信息。

Same Patch Batch · Cisco · 2025-08-27 · 12 CVEs total

CVE-2025-202417.4 HIGHCisco Nexus 3000 and 9000 Series Switches IS-IS Protocol <TBD> Denial of Service Vulnerabi
CVE-2025-202946.5 MEDIUMCisco UCS Manager Software Command Injection Vulnerability
CVE-2025-203446.5 MEDIUMCisco Nexus Dashboard Path Traversal Vulnerability
CVE-2025-202956.0 MEDIUMCisco UCS Manager Software Command Injection Vulnerability
CVE-2025-202905.5 MEDIUMCisco NXOS Software Sensitive Log Information Disclosure Vulnerability
CVE-2025-203425.4 MEDIUMCisco Integrated Management Controller Virtual Keyboard Video Monitor (vKVM) Stored Cross-
CVE-2025-203475.4 MEDIUMCisco Nexus Dashboard Fabric Controller Unauthorized REST API Vulnerability
CVE-2025-202625.0 MEDIUMCisco Nexus 3000 and 9000 Series Switches Protocol Independent Multicast Version 6 Denial
CVE-2025-203485.0 MEDIUMCisco Nexus Dashboard Unauthorized REST API Vulnerability
CVE-2025-202924.4 MEDIUMCisco NXOS Software Command Injection Vulnerability
CVE-2025-20296Cisco UCS Manager Software Stored Software Stored Cross-Site Scripting Vulnerability

IV. Related Vulnerabilities

Same product: Cisco Unified Computing System (Managed)
Same vendor: Cisco
Same weakness: CWE-601

V. Comments for CVE-2025-20317

No comments yet

Leave a comment