Cisco Unified Communications Manager Cross-Site Request Forgery Vulnerability

TL;DR 📌

• A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM) Software and Cisco Unified CM Session Management Edition (SME) Software could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected device. This vulnerability is due to insufficient CSRF protections for the web-based management interface…
• Highest CVSS: 4.3 (Medium).
• Fix available — see the first fixed release below.
• CVEs: CVE-2025-20326.

What it is

CVE-2025-20326 is a cross-site request forgery flaw in the web-based management interface of Cisco Unified Communications Manager (Unified CM) and Unified CM Session Management Edition (SME). The interface does not apply sufficient CSRF protections to requests it processes.

Exploitation requires no authentication on the attacker’s part, but it does require user interaction: an attacker has to persuade someone who is logged into the management interface to click a malicious link. If that succeeds, the attacker’s crafted request executes with whatever privilege level the logged-in user holds, letting the attacker perform arbitrary actions on the affected device as that user.

This sits in the management plane rather than the data plane — it affects the admin web UI, not call-processing or media handling. Cisco states the vulnerability affects Unified CM and Unified CM SME regardless of device configuration, and there are no workarounds. Cisco’s PSIRT says it found this during internal testing and is not aware of public exploitation.

What to do

• Treat this as an admin-interface hardening item rather than an emergency patch, given the CVSS 4.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) and no known exploitation.
• On release 15, upgrade to 15SU3, which contains the fix.
• On release 12.5 or release 14, migrate to a fixed release — Cisco does not offer a patched build on those trains.
• Since there is no workaround, plan the upgrade rather than looking for a mitigating configuration change.
• Advise administrators who use the Unified CM web management UI to be cautious about clicking unsolicited links while logged in, until upgraded.

Fixed releases

For leadership 🧭

Executive summary. An administrator logged into Unified CM’s web management interface could be tricked into clicking a link that performs actions on the system with their privileges, without their knowledge. There’s no workaround, so this needs to go on the upgrade schedule, but with no known exploitation and a medium severity score, it doesn’t require emergency action.

Why it matters:

• The flaw sits in the Unified CM and Unified CM SME admin web UI, meaning any successful exploit acts with the privilege level of whichever administrator is tricked into clicking the link — potentially full admin control of call-processing configuration.
• Affects Unified CM and SME regardless of device configuration, so there is no configuration-based way to reduce exposure.
• No workaround exists, so mitigation depends entirely on completing the upgrade rather than any interim hardening step.
• Releases 12.5 and 14 have no patched build at all — organisations on those trains must migrate to a newer release, not just apply a fix.

Now / Next / Later:

• Now: Identify all Unified CM and Unified CM SME instances still running release 12.5, 14, or pre-15SU3, and flag them for upgrade planning.
• Next: Upgrade release 15 deployments to 15SU3, and migrate any 12.5 or 14 deployments to a fixed release train during the next maintenance window.
• Later: Build periodic release-currency checks for Unified CM into standard patch cadence, and remind administrators to avoid clicking unsolicited links while authenticated to the management interface.

Source

• Cisco advisory
• CVE-2025-20326 on NVD