{"api_version":"1","generated_at":"2026-11-04T18:12:07+00:00","cve":"CVE-2025-20376","urls":{"html":"https://cve.report/CVE-2025-20376","api":"https://cve.report/api/cve/CVE-2025-20376.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2025-20376","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2025-20376"},"summary":{"title":"Cisco Unified Contact Center Express Remote Code Execution Vulnerability","description":"A vulnerability in the web UI of Cisco Unified CCX could allow an authenticated, remote attacker to upload and execute arbitrary files.\r\n\r\nThis vulnerability is due to an insufficient input validation associated to file upload mechanisms. An attacker could exploit this vulnerability by uploading a malicious file to the web UI and executing it. A successful exploit could allow the attacker to execute arbitrary commands on the underlying system and elevate privileges to root. To exploit this vulnerability, the attacker must have valid administrative credentials.","state":"PUBLISHED","assigner":"cisco","published_at":"2025-11-05 17:15:38","updated_at":"2026-06-17 08:41:38"},"problem_types":["CWE-434","CWE-434 Unrestricted Upload of File with Dangerous Type"],"metrics":[{"version":"3.1","source":"nvd@nist.gov","type":"Primary","score":"7.2","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},{"version":"3.1","source":"psirt@cisco.com","type":"Secondary","score":"6.5","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"}},{"version":"3.1","source":"CNA","type":"CVSSV3_1","score":"6.5","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","data":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","version":"3.1"}}],"references":[{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cc-mult-vuln-gK4TFXSn","name":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cc-mult-vuln-gK4TFXSn","refsource":"psirt@cisco.com","tags":["Vendor Advisory"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-20376","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-20376","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Cisco","product":"Cisco Unified Contact Center Express","version":"affected 10.5(1)SU1","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Unified Contact Center Express","version":"affected 10.6(1)","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Unified Contact Center Express","version":"affected 11.6(1)","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Unified Contact Center Express","version":"affected 10.6(1)SU1","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Unified Contact Center Express","version":"affected 10.6(1)SU3","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Unified Contact Center Express","version":"affected 11.6(2)","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Unified Contact Center Express","version":"affected 12.0(1)","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Unified Contact Center Express","version":"affected 11.0(1)SU1","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Unified Contact Center Express","version":"affected 11.5(1)SU1","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Unified Contact Center Express","version":"affected 10.5(1)","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Unified Contact Center Express","version":"affected 12.5(1)","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Unified Contact Center Express","version":"affected 12.5(1)SU1","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Unified Contact Center Express","version":"affected 12.5(1)SU2","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Unified Contact Center Express","version":"affected 12.5(1)SU3","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Unified Contact Center Express","version":"affected 12.5(1)_SU03_ES01","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Unified Contact Center Express","version":"affected 12.5(1)_SU03_ES02","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Unified Contact Center Express","version":"affected 12.5(1)_SU02_ES03","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Unified Contact Center Express","version":"affected 12.5(1)_SU02_ES04","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Unified Contact Center Express","version":"affected 12.5(1)_SU02_ES02","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Unified Contact Center Express","version":"affected 12.5(1)_SU01_ES02","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Unified Contact Center Express","version":"affected 12.5(1)_SU01_ES03","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Unified Contact Center Express","version":"affected 12.5(1)_SU02_ES01","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Unified Contact Center Express","version":"affected 11.6(2)ES07","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Unified Contact Center Express","version":"affected 11.6(2)ES08","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Unified Contact Center Express","version":"affected 12.5(1)_SU01_ES01","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Unified Contact Center Express","version":"affected 12.0(1)ES04","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Unified Contact Center Express","version":"affected 12.5(1)ES02","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Unified Contact Center Express","version":"affected 12.5(1)ES03","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Unified Contact Center Express","version":"affected 11.6(2)ES06","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Unified Contact Center Express","version":"affected 12.5(1)ES01","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Unified Contact Center Express","version":"affected 12.0(1)ES03","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Unified Contact Center Express","version":"affected 12.0(1)ES01","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Unified Contact Center Express","version":"affected 11.6(2)ES05","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Unified Contact Center Express","version":"affected 12.0(1)ES02","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Unified Contact Center Express","version":"affected 11.6(2)ES04","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Unified Contact Center Express","version":"affected 11.6(2)ES03","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Unified Contact Center Express","version":"affected 11.6(2)ES02","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Unified Contact Center Express","version":"affected 11.6(2)ES01","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Unified Contact Center Express","version":"affected 10.6(1)SU3ES03","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Unified Contact Center Express","version":"affected 11.0(1)SU1ES03","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Unified Contact Center Express","version":"affected 10.6(1)SU3ES01","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Unified Contact Center Express","version":"affected 10.5(1)SU1ES10","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Unified Contact Center Express","version":"affected 11.5(1)SU1ES03","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Unified Contact Center Express","version":"affected 11.6(1)ES02","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Unified Contact Center Express","version":"affected 11.5(1)ES01","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Unified Contact Center Express","version":"affected 10.6(1)SU2","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Unified Contact Center Express","version":"affected 10.6(1)SU2ES04","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Unified Contact Center Express","version":"affected 11.6(1)ES01","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Unified Contact Center Express","version":"affected 10.6(1)SU3ES02","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Unified Contact Center Express","version":"affected 11.5(1)SU1ES02","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Unified Contact Center Express","version":"affected 11.5(1)SU1ES01","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Unified Contact Center Express","version":"affected 11.0(1)SU1ES02","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Unified Contact Center Express","version":"affected 12.5(1)_SU03_ES03","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Unified Contact Center Express","version":"affected 12.5(1)_SU03_ES04","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Unified Contact Center Express","version":"affected 12.5(1)_SU03_ES05","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Unified Contact Center Express","version":"affected UCCX 15.0.1","platforms":[]},{"source":"CNA","vendor":"Cisco","product":"Cisco Unified Contact Center Express","version":"affected 12.5(1)_SU03_ES06","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[{"source":"CNA","title":"","value":"The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory.","time":"","lang":"en"}],"credits":[],"nvd_cpes":[{"cve_year":"2025","cve_id":"20376","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"cisco","cpe5":"unified_contact_center_express","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2025","cve_id":"20376","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"cisco","cpe5":"unified_contact_center_express","cpe6":"15.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2025","cve_id":"20376","cve":"CVE-2025-20376","epss":"0.004780000","percentile":"0.398490000","score_date":"2026-10-18","updated_at":"2026-10-19 00:13:06"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2025-20376","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","timestamp":"2025-11-06T04:55:45.488528Z","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2026-02-26T17:47:14.572Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"defaultStatus":"unknown","product":"Cisco Unified Contact Center Express","vendor":"Cisco","versions":[{"status":"affected","version":"10.5(1)SU1"},{"status":"affected","version":"10.6(1)"},{"status":"affected","version":"11.6(1)"},{"status":"affected","version":"10.6(1)SU1"},{"status":"affected","version":"10.6(1)SU3"},{"status":"affected","version":"11.6(2)"},{"status":"affected","version":"12.0(1)"},{"status":"affected","version":"11.0(1)SU1"},{"status":"affected","version":"11.5(1)SU1"},{"status":"affected","version":"10.5(1)"},{"status":"affected","version":"12.5(1)"},{"status":"affected","version":"12.5(1)SU1"},{"status":"affected","version":"12.5(1)SU2"},{"status":"affected","version":"12.5(1)SU3"},{"status":"affected","version":"12.5(1)_SU03_ES01"},{"status":"affected","version":"12.5(1)_SU03_ES02"},{"status":"affected","version":"12.5(1)_SU02_ES03"},{"status":"affected","version":"12.5(1)_SU02_ES04"},{"status":"affected","version":"12.5(1)_SU02_ES02"},{"status":"affected","version":"12.5(1)_SU01_ES02"},{"status":"affected","version":"12.5(1)_SU01_ES03"},{"status":"affected","version":"12.5(1)_SU02_ES01"},{"status":"affected","version":"11.6(2)ES07"},{"status":"affected","version":"11.6(2)ES08"},{"status":"affected","version":"12.5(1)_SU01_ES01"},{"status":"affected","version":"12.0(1)ES04"},{"status":"affected","version":"12.5(1)ES02"},{"status":"affected","version":"12.5(1)ES03"},{"status":"affected","version":"11.6(2)ES06"},{"status":"affected","version":"12.5(1)ES01"},{"status":"affected","version":"12.0(1)ES03"},{"status":"affected","version":"12.0(1)ES01"},{"status":"affected","version":"11.6(2)ES05"},{"status":"affected","version":"12.0(1)ES02"},{"status":"affected","version":"11.6(2)ES04"},{"status":"affected","version":"11.6(2)ES03"},{"status":"affected","version":"11.6(2)ES02"},{"status":"affected","version":"11.6(2)ES01"},{"status":"affected","version":"10.6(1)SU3ES03"},{"status":"affected","version":"11.0(1)SU1ES03"},{"status":"affected","version":"10.6(1)SU3ES01"},{"status":"affected","version":"10.5(1)SU1ES10"},{"status":"affected","version":"11.5(1)SU1ES03"},{"status":"affected","version":"11.6(1)ES02"},{"status":"affected","version":"11.5(1)ES01"},{"status":"affected","version":"10.6(1)SU2"},{"status":"affected","version":"10.6(1)SU2ES04"},{"status":"affected","version":"11.6(1)ES01"},{"status":"affected","version":"10.6(1)SU3ES02"},{"status":"affected","version":"11.5(1)SU1ES02"},{"status":"affected","version":"11.5(1)SU1ES01"},{"status":"affected","version":"11.0(1)SU1ES02"},{"status":"affected","version":"12.5(1)_SU03_ES03"},{"status":"affected","version":"12.5(1)_SU03_ES04"},{"status":"affected","version":"12.5(1)_SU03_ES05"},{"status":"affected","version":"UCCX 15.0.1"},{"status":"affected","version":"12.5(1)_SU03_ES06"}]}],"descriptions":[{"lang":"en","value":"A vulnerability in the web UI of Cisco Unified CCX could allow an authenticated, remote attacker to upload and execute arbitrary files.\r\n\r\nThis vulnerability is due to an insufficient input validation associated to file upload mechanisms. An attacker could exploit this vulnerability by uploading a malicious file to the web UI and executing it. A successful exploit could allow the attacker to execute arbitrary commands on the underlying system and elevate privileges to root. To exploit this vulnerability, the attacker must have valid administrative credentials."}],"exploits":[{"lang":"en","value":"The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory."}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"format":"cvssV3_1"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-434","description":"Unrestricted Upload of File with Dangerous Type","lang":"en","type":"cwe"}]}],"providerMetadata":{"dateUpdated":"2025-11-05T16:31:38.793Z","orgId":"d1c1063e-7a18-46af-9102-31f8928bc633","shortName":"cisco"},"references":[{"name":"cisco-sa-cc-mult-vuln-gK4TFXSn","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cc-mult-vuln-gK4TFXSn"}],"source":{"advisory":"cisco-sa-cc-mult-vuln-gK4TFXSn","defects":["CSCwq36567"],"discovery":"EXTERNAL"},"title":"Cisco Unified Contact Center Express Remote Code Execution Vulnerability"}},"cveMetadata":{"assignerOrgId":"d1c1063e-7a18-46af-9102-31f8928bc633","assignerShortName":"cisco","cveId":"CVE-2025-20376","datePublished":"2025-11-05T16:31:38.793Z","dateReserved":"2024-10-10T19:15:13.262Z","dateUpdated":"2026-02-26T17:47:14.572Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2025-11-05 17:15:38","lastModifiedDate":"2026-06-17 08:41:38","problem_types":["CWE-434","CWE-434 Unrestricted Upload of File with Dangerous Type"],"metrics":{"cvssMetricV31":[{"source":"psirt@cisco.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":1.2,"impactScore":5.2},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-11-06T04:55:45.488528Z","id":"CVE-2025-20376","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:cisco:unified_contact_center_express:*:*:*:*:*:*:*:*","versionEndExcluding":"12.5\\(1\\)_su03_es07","matchCriteriaId":"6EF18C21-6E70-4748-99FA-884754F44D1A"},{"vulnerable":true,"criteria":"cpe:2.3:a:cisco:unified_contact_center_express:15.0:*:*:*:*:*:*:*","matchCriteriaId":"124C88AE-ED0C-4CBC-A84D-200EDB776C8C"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2025","CveId":"20376","Ordinal":"1","Title":"Cisco Unified Contact Center Express Remote Code Execution Vulne","CVE":"CVE-2025-20376","Year":"2025"},"notes":[{"CveYear":"2025","CveId":"20376","Ordinal":"1","NoteData":"A vulnerability in the web UI of Cisco Unified CCX could allow an authenticated, remote attacker to upload and execute arbitrary files.\r\n\r\nThis vulnerability is due to an insufficient input validation associated to file upload mechanisms. An attacker could exploit this vulnerability by uploading a malicious file to the web UI and executing it. A successful exploit could allow the attacker to execute arbitrary commands on the underlying system and elevate privileges to root. To exploit this vulnerability, the attacker must have valid administrative credentials.","Type":"Description","Title":"Cisco Unified Contact Center Express Remote Code Execution Vulne"}]}}}