{"id":5704,"date":"2025-11-07T01:45:52","date_gmt":"2025-11-07T01:45:52","guid":{"rendered":"https:\/\/cybersecurityinfocus.com\/?p=5704"},"modified":"2025-11-07T01:45:52","modified_gmt":"2025-11-07T01:45:52","slug":"cisco-fixes-critical-flaws-in-unified-contact-center-express","status":"publish","type":"post","link":"https:\/\/cybersecurityinfocus.com\/?p=5704","title":{"rendered":"Cisco fixes critical flaws in Unified Contact Center Express"},"content":{"rendered":"
\n
\n
\n
\n
<\/div>\n

Cisco released patches for two critical vulnerabilities in its Unified Contact Center Express (CCX) that could allow attackers to bypass authentication and execute commands as root on the underlying system.<\/p>\n

The company also warned today about a new attack variation targeting two previously patched vulnerabilities in its Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) software. The flaws were exploited in the wild by a cyberespionage group tracked as UAT4356 or Storm-1849.<\/p>\n

The two vulnerabilities in Unified CCX impact version 15.0, as well as versions 12.5 SU3 and earlier, regardless of configuration. The company released versions 15.0 ES01 and 12.5 SU3 ES07 to address these flaws and urged customers to install them.<\/p>\n

Cisco Unified CCX is a contact center solution for midsize businesses with up to 400 agents. It performs automated call routing and interactive voice response, and it enables agents to interact with customers through multiple channels, including voice, web chat, email, and social media through a unified desktop client.<\/p>\n

Authentication bypass and remote code execution<\/h2>\n

One of the flaws, tracked as CVE-2025-20354, is located in the Editor application and allows a remote attacker to bypass authentication and obtain the ability to create and execute scripts with administrative privileges. This vulnerability received a CVSS rating of 9.4 out of 10.<\/p>\n

\u201cThis vulnerability is due to improper authentication mechanisms in the communication between the CCX Editor and an affected Unified CCX server,\u201d the company said in its advisory<\/a>. \u201cAn attacker could exploit this vulnerability by redirecting the authentication flow to a malicious server and tricking the CCX Editor into believing the authentication was successful.\u201d<\/p>\n

The second flaw, tracked as CVE-2025-20354, could allow an unauthenticated attacker to upload a specially crafted file to a vulnerable Cisco Unified CCX server through the Java Remote Method Invocation (RMI) process. This attack could result in the execution of commands on the underlying OS with root privileges. The CVSS severity rating for this flaw is 9.8.<\/p>\n

While Cisco is not aware of any malicious exploitation of these flaws, users should deploy the patches as soon as possible as these are the type of flaws that attackers tend to adopt very quickly.<\/p>\n

The company has also patched four medium severity flaws<\/a> in Unified CCX, Cisco Unified Contact Center Enterprise (CCE), Cisco Packaged Contact Center Enterprise (CCE) and Cisco Unified Intelligence Center (UIC).<\/p>\n

Tracked as CVE-2025-20374, CVE-2025-20375, CVE-2025-20376, and CVE-2025-20377, these flaws can lead to sensitive information disclosure, arbitrary file download, arbitrary command execution, and privilege escalation to root. However, to be exploited, they require authentication as a valid user.<\/p>\n

New attack variant for ASA and FTD<\/h2>\n

Separately, Cisco warned that hackers have developed a new attack variant for CVE-2025-20333<\/a> and CVE-2025-20362<\/a>, two actively exploited flaws in Cisco ASA and FTD originally patched in September. While the flaws were initially exploited for unauthorized access to VPN endpoints and remote code execution, the new attack variation can only lead to unexpected device reboots and denial-of-service conditions.<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>","protected":false},"excerpt":{"rendered":"

Cisco released patches for two critical vulnerabilities in its Unified Contact Center Express (CCX) that could allow attackers to bypass authentication and execute commands as root on the underlying system. The company also warned today about a new attack variation targeting two previously patched vulnerabilities in its Secure Firewall Adaptive Security Appliance (ASA) and Secure […]<\/p>\n","protected":false},"author":0,"featured_media":5705,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-5704","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-education"],"_links":{"self":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/5704"}],"collection":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=5704"}],"version-history":[{"count":0,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/5704\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/media\/5705"}],"wp:attachment":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=5704"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=5704"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=5704"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}