Cisco Unified Intelligent Contact Management Enterprise Cross-Site Scripting

🚨SEVERITY: MEDIUM — CVSS 6.1Security Advisory

TL;DR 📌

  • A vulnerability in the web-based management interface of Cisco Unified Intelligent Contact Management Enterprise could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. This vulnerability is due to insufficient user input validation. An attacker could exploit this vulnerability by…
  • Highest CVSS: 6.1 (Medium).
  • Check the advisory for fixed releases — remediation detail is in the vendor link below.
  • CVEs: CVE-2025-20273.

What it is

CVE-2025-20273 is a cross-site scripting flaw in the web-based management interface of Cisco Unified Intelligent Contact Management Enterprise (ICM Enterprise). It stems from insufficient input validation on that interface.

The attack path is unauthenticated and remote, but requires user interaction: an attacker crafts a malicious link and persuades a user of the management interface to click it. There’s no need for the attacker to hold valid credentials on the device itself.

A successful exploit lets the attacker run arbitrary script in the context of the management interface, or pull sensitive browser-based information from the victim’s session. This is a client-side attack against the administrator’s browser session, not direct compromise of the ICM Enterprise data plane.

Cisco lists ICM Enterprise 15.0(1) and earlier as affected. Cisco has stated it plans to release software updates but had not done so at the time of publication, and there are no workarounds.

What to do

  • Treat this as a phishing-style risk against ICM Enterprise administrators: brief staff who use the web management interface not to click unsolicited or unexpected links tied to it.
  • Restrict access to the ICM Enterprise management interface to trusted networks and management VLANs where possible, since there’s no workaround for the underlying flaw itself.
  • Watch Cisco’s advisory for the fixed release; none was available at publication, so check back for the update covering 15.0(1) and earlier.
  • No configuration change mitigates this — Cisco explicitly states there are no workarounds — so patching once available is the only fix.

For leadership 🧭

Executive summary. Cisco has confirmed a cross-site scripting bug in the ICM Enterprise management interface that could let an attacker hijack an administrator’s browser session via a crafted link, with no fix or workaround currently available. It’s not being exploited in the wild, so treat it as a medium-priority tracking item rather than an emergency, but restrict interface access and brief admins now.

Why it matters:

  • The flaw sits in the web-based management interface of ICM Enterprise, meaning the target is the administrator’s browser session, not the call-routing data plane itself.
  • Exploitation requires no credentials on the device, only that an ICM Enterprise admin clicks a malicious link, making it a phishing-style risk against contact centre operations staff.
  • A successful attack lets the attacker execute arbitrary script in the interface’s context or read sensitive browser-based session data, which could enable further access.
  • Cisco has stated there is no workaround, so exposure persists on every affected 15.0(1) or earlier deployment until a patch ships.

Now / Next / Later:

  • Now: Brief anyone with access to the ICM Enterprise web management interface not to click unsolicited or unexpected links associated with it.
  • Next: Restrict network access to the ICM Enterprise management interface to trusted management networks or VLANs, since no configuration workaround exists for the underlying flaw.
  • Later: Track Cisco’s advisory for the fixed release covering ICM Enterprise 15.0(1) and earlier, and schedule the upgrade as soon as it is published.

Source