Cisco Unified Contact Center Express Vulnerabilities

TL;DR 📌

• Multiple vulnerabilities in the web-based management interface of Cisco Unified Contact Center Express (Unified CCX) could allow an authenticated, remote attacker to perform a stored cross-site scripting (XSS) attack or execute arbitrary code on an affected device. To exploit these vulnerabilities, the attacker must have valid administrative credentials. For more information about these vulnerabilities, see the Details ["#details"] section of…
• No fixed release listed yet; apply mitigations and monitor.
• Workarounds are documented in the advisory.
• CVEs: CVE-2025-20276, CVE-2025-20277, CVE-2025-20279.

What happened 🕵️‍♂️

The vulnerabilities are not dependent on one another. Exploitation of one of the vulnerabilities is not required to exploit another vulnerability. In addition, a software release that is affected by one of the vulnerabilities may not be affected by the other vulnerabilities.

Details about the vulnerabilities are as follows:

CVE-2025-20279: Cisco Unified CCX Stored XSS Vulnerability

A vulnerability in the web-based management interface of Cisco Unified CCX could allow an authenticated, remote attacker to conduct a stored XSS attack on an affected system. To exploit this vulnerability, the attacker must have valid administrative credentials.

This vulnerability is due to improper sanitization of user input to the web-based management interface. An attacker could exploit this vulnerability by submitting a malicious script through the interface. A successful exploit could allow the attacker to conduct a stored XSS attack on the affected system.

Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

Bug ID(s): CSCwk24130 [“https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwk24130”] CVE ID: CVE-2025-20279 Security Impact Rating (SIR): Medium CVSS Base Score: 4.8 CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

CVE-2025-20276: Cisco Unified CCX Remote Code Execution Vulnerability

A vulnerability in the web-based management interface of Cisco Unified CCX could allow an authenticated, remote attacker to execute arbitrary code on an affected device. To exploit this vulnerability, the attacker must have valid administrative credentials.

This vulnerability is due to insecure deserialization of Java objects by the affected software. An attacker could exploit this vulnerability by sending a crafted Java object to an affected device. A successful exploit could allow the attacker to execute arbitrary code on the underlying operating system of an affected device as a low-privilege user. A successful exploit could also allow the attacker to undertake further actions to elevate their privileges to root.

Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

Bug ID(s): CSCwk24108 [“https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwk24108”] CVE ID: CVE-2025-20276 Security Impact Rating (SIR): Medium CVSS Base Score: 3.8 CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N

CVE-2025-20277: Cisco Unified CCX Path Traversal Vulnerability

A vulnerability in the web-based management interface of Cisco Unified CCX could allow an authenticated, local attacker to execute arbitrary code on an affected device. To exploit this vulnerability, the attacker must have valid administrative credentials.

This vulnerability is due to improper limitation of a pathname to a restricted directory (path traversal). An attacker could exploit this vulnerability by sending a crafted web request to an affected device, followed by a specific command through an SSH session. A successful exploit could allow the attacker to execute arbitrary code on the underlying operating system of an affected device as a low-privilege user. A successful exploit could also allow the attacker to undertake further actions to elevate their privileges to root.

Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

Bug ID(s): CSCwk24068 [“https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwk24068”] CVE ID: CVE-2025-20277 Security Impact Rating (SIR): Medium CVSS Base Score: 3.4 CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N

Affected products 🖥️

At the time of publication, these vulnerabilities affected Cisco Unified CCX.

For information about which Cisco software releases were vulnerable at the time of publication, see the Fixed Software ["#fs"] section of this advisory. See the Details section in the bug ID(s) at the top of this advisory for the most complete and current information.

Fixed software 🔧

Upgrade to the first fixed release in your train (or later):

Workarounds 🧯

There are no workarounds that address these vulnerabilities.

Risk in context 🎯

Use vendor CVSS for prioritization. Consider exposure and asset criticality.

Fast facts ⚡

• Advisory: cisco-sa-uccx-multi-UhOTvPGL
• Initial release: 2025-06-04T16:00:00 UTC
• Last updated: 2025-06-04T16:00:00 UTC

For leadership 🧭

Executive summary. Cisco Unified CCX’s management interface has three distinct medium-severity bugs that let an admin-level account escalate to root or plant persistent scripts, with fixes already available in the 15.0(1) release. There’s no workaround, so this needs scheduling into a change window rather than urgent out-of-hours action.

Why it matters:

• CVE-2025-20276 lets an authenticated admin trigger insecure Java deserialisation to run arbitrary code as a low-privilege user, with a path to root on the underlying OS.
• CVE-2025-20277 requires local access but chains a crafted web request with an SSH command to achieve the same root-level code execution via path traversal.
• CVE-2025-20279 lets an admin plant a stored XSS payload in the web management interface, which can then execute against any admin who later views the affected page.
• All three require valid administrative credentials, so compromise of a single admin account on Unified CCX now carries a route to full host takeover, not just contact-centre configuration access.

Now / Next / Later:

• Now: Review who holds administrative credentials to Unified CCX and confirm none of those accounts are shared, weakly protected, or accessible from untrusted networks.
• Next: Upgrade Unified CCX to 15.0(1) or later in the next available change window, since Cisco has issued fixes but no workarounds exist for any of the three CVEs.
• Later: Tighten admin access controls on Unified CCX’s management interface (MFA, restricted source IPs, session logging) so a single compromised admin credential cannot be leveraged into root-level code execution.