Cisco Unified Communications Manager Stored Cross-Site Scripting Vulnerability
TL;DR 📌
- A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. This vulnerability exists because the web-based management interface does not properly…
- Highest CVSS: 4.8 (Medium).
- Fix available — see the first fixed release below.
- CVEs: CVE-2025-20361.
What it is
CVE-2025-20361 is a stored cross-site scripting flaw in the web-based management interface of Cisco Unified Communications Manager (Unified CM) and Unified Communications Manager Session Management Edition (Unified CM SME). The interface fails to properly validate user-supplied input on certain pages, allowing malicious code to be stored and later executed in another user’s browser session.
Exploitation requires an authenticated, remote attacker with valid administrative credentials. This is not an unauthenticated route in — an attacker needs admin access to the management interface first, then injects script into specific pages. When another administrative user views the affected page, the injected code runs in the context of that interface, giving the attacker the ability to execute arbitrary script or access sensitive browser-based information (such as session data) belonging to that user.
The flaw affects Unified CM and Unified CM SME “regardless of device configuration,” per Cisco. It was found during Cisco’s internal security testing; Cisco PSIRT states it is not aware of any public announcements or malicious use.
What to do
- Upgrade to the fixed release. For Release 15, the fix is in 15SU3. Releases 12.5 and 14 have no fix in-branch — Cisco advises migrating to a fixed release rather than waiting for a patch on those trains.
- There are no workarounds. Patching is the only mitigation Cisco offers for this issue.
- Given exploitation requires valid admin credentials, tighten who holds administrative access to the Unified CM web interface and review existing admin accounts as a compensating measure while you plan the upgrade.
- Consult Cisco’s advisory (cisco-sa-cucm-stored-xss-Fnj66YLy) for the associated bug ID(s), which will carry the most current fixed-release detail if that changes after publication.
Fixed releases
| Affected release | First fixed release |
|---|---|
| 15 | 15SU3 |
For leadership 🧭
Executive summary. A stored XSS flaw in Unified CM’s admin web interface lets one logged-in administrator hijack another administrator’s session by planting malicious script on shared management pages. There’s no workaround, so this needs scheduling into the next patch cycle for CUCM/CUCM SME, sooner if your admin population is large or not tightly controlled.
Why it matters:
- Exploitation needs valid administrative credentials on the Unified CM web interface, meaning the risk grows with how many admins have access and how well those accounts are managed.
- A successful attack lets one admin execute script in another admin’s session on the CUCM management interface, potentially exposing browser-based session data used to manage the call control platform.
- Cisco has confirmed no workaround exists, so exposure persists until the affected system is upgraded to a fixed release.
- 12.5 and 14 branches have no in-branch fix at all — those deployments must migrate to a supported release, not just wait for a patch.
Now / Next / Later:
- Now: Review and tighten the list of accounts holding administrative access to the Unified CM web interface, since exploitation depends entirely on possessing valid admin credentials.
- Next: Upgrade Release 15 deployments to 15SU3; for 12.5 or 14, plan migration to a fixed release since no in-branch patch exists.
- Later: Build periodic admin-account audits for Unified CM into standard operating procedure, since this class of flaw specifically targets trust between administrative users on the same interface.