Cisco Unified Communications Products Command Injection Vulnerability

🚨SEVERITY: MEDIUM — CVSS 6.0Security Advisory

TL;DR 📌

  • A vulnerability in the CLI of multiple Cisco Unified Communications products could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system of an affected device as the root user. This vulnerability is due to improper validation of user-supplied command arguments. An attacker could exploit this vulnerability by executing crafted commands…
  • Highest CVSS: 6.0 (Medium).
  • Fix available — see the first fixed release below.
  • CVEs: CVE-2025-20278.

What it is

CVE-2025-20278 is a command injection flaw in the CLI of several Cisco Unified Communications products. It stems from improper validation of user-supplied command arguments passed to CLI commands.

Exploitation requires local access to the device CLI and valid administrative credentials — this is not remotely exploitable by an unauthenticated attacker, and it doesn’t touch the data plane. An administrator (or someone who has obtained admin credentials) who runs a crafted command can break out of the intended CLI context and execute arbitrary commands on the underlying operating system as root.

The affected products are Customer Collaboration Platform (CCP), Finesse, Unified Communications Manager (Unified CM), Unified CM IM&P, Unified CM Session Management Edition (Unified CM SME), Unified Contact Center Express (Unified CCX), Unified Intelligence Center, Unity Connection, and Virtualized Voice Browser. Cisco has not published any workaround for this issue.

What to do

  • Treat this as a privilege escalation path for anyone who already holds admin-level CLI credentials on these platforms — review who has that access and tighten it where possible, since there is no workaround to compensate.
  • Upgrade to the fixed release for your specific product:
    • CCP: 15.0(1)
    • Finesse: 12.6(2)ES6 or 15.0(1)
    • Unified CM / Unified CM SME: 15SU2
    • Unified CM IM&P: 15SU2
    • Unified CCX: 15.0(1)
    • Unified Intelligence Center: 12.6(2)ES04 or 15.0(1)
    • Unity Connection: 15SU2
    • Virtualized Voice Browser: 12.6(2)ES06 or 15.0(1)
  • If running a release earlier than the “Earlier than” thresholds listed above (pre-12.6 or pre-15.0 depending on product), plan a migration to a fixed release rather than a point patch, as Cisco lists no interim fix for those older trains.
  • Audit CLI command logs on these systems for unusual or crafted argument use by administrative accounts, given that exploitation requires that level of access already.

Fixed releases

Affected release First fixed release
15.0 15.0(1)

For leadership 🧭

Executive summary. Anyone already holding admin CLI credentials on Cisco’s Unified Communications platforms - Unified CM, Unity Connection, Finesse, Unified CCX and related products - can escalate to root on the underlying operating system. It requires no new access to exploit, so patching and reviewing who holds admin credentials should be scheduled promptly, though there is no evidence of active exploitation.

Why it matters:

  • Affects the CLI of nine Cisco Unified Communications products, including Unified CM, Unity Connection, Unified CCX and Finesse, which typically sit at the core of enterprise voice and contact centre infrastructure.
  • A user who already has valid administrative CLI credentials can run crafted commands to gain root on the host OS, turning any compromised or misused admin account into full system control.
  • Cisco has published no workaround, so the only mitigation until upgrade is tightening and monitoring who holds admin-level CLI access.
  • Fixes are spread across different release trains per product, so each affected system needs its own specific target version rather than a single patch.

Now / Next / Later:

  • Now: Review and restrict the list of accounts holding administrative CLI credentials on each affected Unified Communications platform, since exploitation depends entirely on that access.
  • Next: Schedule upgrades to the fixed release for each affected product - for example 15SU2 for Unified CM, Unified CM IM&P and Unity Connection, 15.0(1) for CCP, Unified CCX and Virtualized Voice Browser, and the listed ES patches for Finesse and Unified Intelligence Center.
  • Later: Establish routine auditing of CLI command logs on Unified Communications systems and enforce tighter, more granular controls over who is granted administrative CLI access.

Source