Cisco Unified CCX Unauthenticated RCE via Java RMI (CVE-2025-20354/20358)

This web screenshot reveals a remote code execution vulnerability in Cisco Unified Contact Center Express (Unified CCX). Key information is as follows: Vulnerability Summary: - Multiple vulnerabilities have been identified affecting the Java Remote Method Invocation (RMI) process in Cisco Unified CCX. - These allow remote attackers to upload arbitrary files, bypass authentication, execute arbitrary commands, and escalate privileges to root, all without authentication. Affected Products: - Cisco Unified CCX, regardless of device configuration. Products Confirmed Not Vulnerable: - Packaged Contact Center Enterprise (Packaged CCE) and Unified Contact Center Enterprise (Unified CCE). Vulnerability Details: - CVE-2025-20354: Allows unauthenticated remote attackers to upload files and execute commands with root privileges by exploiting the Java RMI process on affected systems. This vulnerability results from improper authentication mechanisms in specific Cisco Unified CCX features. - CVE-2025-20358: An authentication bypass vulnerability exists in the Cisco Unified CCX Editor application, potentially allowing remote attackers to create and execute arbitrary scripts and gain administrative privileges on the system. This is due to improper authentication mechanisms in communications between the CCX Editor and the affected Unified CCX server. Mitigations: - No mitigations are currently available for these vulnerabilities. Cisco recommends installing the latest patched software. Patched Software: - Customers are advised to upgrade to the recommended patched software versions. - The corresponding patched versions are 12.5 SU3 ES07 and 15.0 ES01. Exploitation and Public Disclosure: - Cisco PSIRT is not aware of any public exploitation or malicious use of these vulnerabilities at this time. Source: - Cisco thanks security researcher Jahmel Harris for reporting these vulnerabilities. Links: - Related advisory: Cisco Security Advisory: Cisco Unified Contact Center Express Remote Code Execution Vulnerabilities

Goal Reached Thanks to every supporter — we hit 100%!

Cisco Unified CCX Unauthenticated RCE via Java RMI (CVE-2025-20354/20358)