CVE-2025-20354

The vulnerability results from improper authentication mechanisms associated with specific Cisco Unified CCX functions handled by the Java RMI process. An attacker can send a crafted file to the vulnerable system via the Java RMI interface without needing to possess any credentials. The uploaded file is then processed in a way that allows execution of arbitrary system commands and privilege escalation to root level on the target operating system.

Successful exploitation of this vulnerability allows an attacker to gain full control over the system — execute arbitrary commands with root privileges and potentially access all data and resources of the operating system.

Security patches available from the vendor must be applied in accordance with the references published in the Cisco Security Advisory: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cc-unauth-rce-QeN8h7mQ

Cisco Unified Contact Center Express (Unified CCX) — specific versions indicated in the vendor references (Cisco advisory).