CVE-2025-20375
Cisco Unified Contact Center Express Arbitrary File Upload Vulnerability
Description
A vulnerability in the web UI of Cisco Unified CCX could allow an authenticated, remote attacker to upload and execute arbitrary files. This vulnerability is due to an insufficient input validation associated to specific UI features. An attacker could exploit this vulnerability by uploading a crafted file to the web UI. A successful exploit could allow the attacker to upload arbitrary files to a vulnerable system and execute them, gaining access to the underlying operating system. To exploit this vulnerability, the attacker must have valid administrative credentials.
Weakness: CWE-434
Affected products
| Vendor | Product | Category | Matched by |
|---|---|---|---|
| Cisco | Cisco Contact Center | Other Products | cna-assigner |
Vendor-reported products (1)
- Cisco · Cisco Unified Contact Center Express
Vendor advisory
cisco-sa-cc-mult-vuln-gK4TFXSn
Multiple Cisco Contact Center Products Vulnerabilities
Cisco’s rating: Medium (advisory CVSS 6.5) · Published Nov 5, 2025 · updated Nov 18, 2025 (revision 1.2)
Bug IDs: CSCwq36567 , CSCwq36596 , CSCwq36645 , CSCwq36646 , CSCwq53352
The vendor’s rating applies to the whole advisory and can differ from this CVE’s own CVSS severity. Where this comes from