CVE-2025-20358 Cisco Unified Contact Center Express Editor Authentication Bypass Vulnerability
Unauthenticated attackers can bypass authentication to create and execute arbitrary scripts on Cisco Unified CCX servers, leading to code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-20358?
CVE-2025-20358 is a critical authentication bypass vulnerability in Cisco Unified Contact Center Express, published on 5 Nov 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability in the Contact Center Express (CCX) Editor application of Cisco Unified CCX could allow an unauthenticated, remote attacker to bypass authentication and obtain administrative permissions pertaining to script creation and execution. This vulnerability is due to improper authentication mechanisms in the communication between the CCX Editor and an affected Unified CCX server. An attacker could exploit this vulnerability by redirecting the authentication flow to a malicious server and tricking the CCX Editor into believing the authentication was successful. A successful exploit could allow the attacker to create and execute arbitrary scripts on the underlying operating system of an affected Unified CCX server, as an internal non-root user account.
Weakness: CWE-306
Which versions are affected by CVE-2025-20358?
It affects 1 product.
Products include Cisco Unified Contact Center Express.
How do I fix CVE-2025-20358?
No fix has been published for CVE-2025-20358 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2025-20358 being exploited?
There is no known exploitation of CVE-2025-20358 in the wild and no public exploit code.
Other vulnerabilities in Cisco Unified Contact Center Express
- CVE-2025-20354 Cisco Unified Contact Center Express Remote Code Execution Vulnerability
- CVE-2020-3280 Cisco Unified Contact Center Express Remote Code Execution Vulnerability
- CVE-2018-0403 Information disclosure in Cisco Unified Contact Center Express unknown
- CVE-2022-20658 Privilege escalation in Cisco Unified Contact Center Domain Manager
- CVE-2018-0402 Cross-site request forgery in Cisco Unified Contact Center Express unknown
Sources
Also known as GHSA-w3hc-3vf9-xjj9.