Cisco Unified Contact Center Express Remote Code Execution Vulnerabilities

🚨SEVERITY: CRITICAL — CVSS 9.8Security Advisory

TL;DR 📌

  • Multiple vulnerabilities in the Java Remote Method Invocation (RMI) process of Cisco Unified Contact Center Express (Unified CCX) could allow an unauthenticated, remote attacker to upload arbitrary files, bypass authentication, execute arbitrary commands, and elevate privileges to root. For more information about these vulnerabilities, see the Details ["#details"] section of this advisory. Cisco has released…
  • Highest CVSS: 9.8 (Critical).
  • Fix available — see the first fixed release below.
  • CVEs: CVE-2025-20354, CVE-2025-20358.

What it is

Cisco Unified Contact Center Express (Unified CCX) carries two unrelated but equally severe flaws in its Java Remote Method Invocation (RMI) process and its CCX Editor application. Neither depends on the other; each can be exploited on its own.

CVE-2025-20354 sits in the Java RMI process itself. Improper authentication in specific Unified CCX features lets an unauthenticated, remote attacker upload a crafted file via RMI and use it to execute arbitrary commands on the underlying OS, with root permissions. This is a network-reachable, no-credentials-needed path straight to full system compromise. CVSS 9.8.

CVE-2025-20358 is an authentication bypass in the CCX Editor’s communication with the Unified CCX server. The Editor’s authentication flow can be redirected to a malicious server, which tricks the client into believing authentication succeeded. A successful attacker gains administrative rights over script creation and execution, and can then create and run arbitrary scripts on the server’s underlying OS — though as an internal non-root user, not root. CVSS 9.4.

Both affect Unified CCX regardless of device configuration. Cisco has confirmed Packaged CCE and Unified CCE are not affected — this is specific to Unified CCX.

What to do

  • Upgrade Unified CCX. Cisco has published fixed releases: 12.5 SU3 and earlier move to 12.5 SU3 ES07; 15.0 moves to 15.0 ES01. There are no workarounds for either vulnerability, so patching is the only remediation path.
  • Treat this as urgent for any Unified CCX deployment reachable from untrusted networks — CVE-2025-20354 requires no authentication and reaches root directly via RMI.
  • Don’t rely on network segmentation alone as a stopgap for CVE-2025-20358; the attack works by redirecting the CCX Editor’s authentication flow to an attacker-controlled server, so anything that can intercept or redirect that traffic is a viable path.
  • Confirm your current release against the fixed releases table in the advisory before assuming you’re clear — both the 12.5 SU3 and 15.0 trains have separate fixes.

Fixed releases

Affected release First fixed release
15.0 15.0 ES01

For leadership 🧭

Executive summary. Any internet- or untrusted-network-reachable Unified CCX server can be taken over without credentials, with one path leading straight to root access on the underlying OS. There is no workaround, so this needs patching on the next available change window, sooner if the system is exposed beyond trusted networks.

Why it matters:

  • CVE-2025-20354 lets an unauthenticated remote attacker upload a crafted file via the Java RMI process and execute arbitrary commands with root permissions — full system compromise with no credentials needed.
  • CVE-2025-20358 lets an attacker redirect the CCX Editor’s authentication flow to a malicious server, tricking it into thinking authentication succeeded, then create and run arbitrary scripts as an internal non-root user.
  • Both flaws affect Unified CCX regardless of device configuration, and Cisco has stated there are no workarounds — patching is the only fix.
  • Packaged CCE and Unified CCE are confirmed unaffected, so remediation effort should focus specifically on Unified CCX estates.

Now / Next / Later:

  • Now: Identify every Unified CCX server and check its release against the fixed releases table — 12.5 SU3 and earlier need 12.5 SU3 ES07, and 15.0 needs 15.0 ES01 — prioritising any instance reachable from untrusted networks.
  • Next: Schedule and apply the appropriate fixed release (12.5 SU3 ES07 or 15.0 ES01) in the next change window; since there are no workarounds, this is the only way to close CVE-2025-20354 and CVE-2025-20358.
  • Later: Review network placement of Unified CCX and the CCX Editor’s authentication path so that RMI access and editor-to-server traffic cannot be reached or redirected by untrusted parties, reducing exposure ahead of future advisories.

Source