Cyber Posture

CVE-2025-20354

Critical

Published: 05 November 2025

Published
05 November 2025
Modified
07 November 2025
KEV Added
Patch
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0018 39.7th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.

Security Summary

CVE-2025-20354 is a critical vulnerability in the Java Remote Method Invocation (RMI) process of Cisco Unified CCX, arising from improper authentication mechanisms associated with specific features. Published on 2025-11-05, it carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and is classified under CWE-434 (Unrestricted Upload of File with Dangerous Type). The flaw allows an unauthenticated, remote attacker to upload arbitrary files to an affected system.

An unauthenticated, remote attacker can exploit the vulnerability by uploading a crafted file through the Java RMI process. Successful exploitation enables the attacker to execute arbitrary commands on the underlying operating system and elevate privileges to root.

The Cisco Security Advisory at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cc-unauth-rce-QeN8h7mQ provides details on affected versions and recommended mitigations.

Details

CWE(s)
CWE-434

Affected Products

cisco
unified contact center express
15.0 · ≤ 12.5\(1\)_su03_es07

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
Why these techniques?

Unauthenticated remote exploitation of public-facing Java RMI service for arbitrary file upload leading to OS command execution (T1190); directly enables root privilege escalation via exploitation (T1068).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References