Product:
Cisco Unified CCX
Summary
A vulnerability in the web UI of Cisco Unified CCX could allow an authenticated, remote attacker to perform a directory traversal and access arbitrary resources. This vulnerability is due to insufficient input validation associated with specific UI features. An attacker could exploit this vulnerability by sending a crafted request to the web UI, potentially gaining read access to arbitrary files on the underlying operating system.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 4.9 | CVE-2025-20374 |
Exploitation
To exploit this vulnerability, the attacker must have valid administrative credentials. Once authenticated, the attacker can send a specially crafted request to the web UI, which may allow them to traverse directories and access sensitive files on the system.
Affected Products
- Cisco Unified CCX: Affected by the vulnerability in its web UI, allowing directory traversal and unauthorized file access.
Mitigation
To mitigate this vulnerability, it is recommended to implement strict access controls and ensure that only authorized users have administrative credentials. Regularly updating the system and applying security patches can also help protect against potential exploits.