CVE-2025-20277

CWE-22 — Path TraversalCWE-502 — Deserialization of Untrusted DataCWE-79 — Cross-site Scripting (XSS)CWE-787 — Out-of-bounds Write5 documents5 sources
Severity
6.7MEDIUM
EPSS
0.1%
top 70.32%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Cisco Cisco Unified Contact Center ExpressCisco Unified Contact Center Express
Timeline
PublishedJun 4

Description

A vulnerability in the web-based management interface of Cisco Unified CCX could allow an authenticated, local attacker to execute arbitrary code on an affected device. To exploit this vulnerability, the attacker must have valid administrative credentials. This vulnerability is due to improper limitation of a pathname to a restricted directory (path traversal). An attacker could exploit this vulnerability by sending a crafted web request to an affected device, followed by a specific command thr…

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:NExploitability: 0.8 | Impact: 2.5

Affected Packages2 packages

🔴Vulnerability Details

2
GHSA
GHSA-6j7v-2g8q-wx49: A vulnerability in the web-based management interface of Cisco Unified CCX could allow an authenticated, local attacker to execute arbitrary code on a↗2025-06-04
▶
CVEList
Cisco Unified Contact Center Express Path Traversal Vulnerability↗2025-06-04
▶

📋Vendor Advisories

2
Cisco
Cisco Unified Contact Center Express Vulnerabilities↗2025-06-04
▶
Microsoft
A flaw was found in Samba's libldb. Multiple consecutive leading spaces in an LDAP attribute can lead to an out-of-bounds memory write leading to a crash of the LDAP server process handling the reques↗2021-05-11
▶
CVE-2025-20277 (MEDIUM CVSS 6.7) | A vulnerability in the web-based ma | cvebase.io