Report feedback

An unauthenticated remote attacker can, due to improperly generated static credentials shared among multiple Identity Services Engine (ISE) instances deployed in the same cloud environment (Amazon Web Services - AWS, Microsoft Azure or Oracle Cloud Infrastructure - OCI only) and the same version, gain access to potentially sensitive data, perform limited administrative operations, modify the system configuration or disrupt services within the affected systems. Systems with the Primary Administration node deployed on-premises are not affected by this vulnerability. Detailed information on the fixed versions and mitigation options can be found at [2].

The vulnerability is present in products:

• *:Cisco Identity Services Engine (AWS); >=3.1, <=3.4;
• *:Cisco Identity Services Engine (Microsoft Azure); >=3.2, <=3.4;
• *:Cisco Identity Services Engine (OCI); >=3.2, <=3.4;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:H

More information:

• CVE-2025-20286 at cve.org, NVD
• CWE-259: Use of Hard-coded Password at cwe.mitre.org

The vulnerability was publicly disclosed 4. 6. 2025.

An authenticated remote attacker can, due to insufficient restriction of access to internal services in Cisco Integrated Management Controller (IMC) on Cisco UCS B-Series, UCS C-Series (and specialized appliances built on it), UCS S-Series and UCS X-Series servers (if they accept incoming SSH connections), use specially crafted SSH connection syntax to gain access to internal services with higher privileges and thus make unauthorized modifications to the system, including creating new administrator accounts on the affected device. Detailed information on the fixed versions and mitigation options can be found at [3].

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

More information:

• CVE-2025-20261 at cve.org, NVD
• CWE-923: Improper Restriction of Communication Channel to Intended Endpoints at cwe.mitre.org

The vulnerability was publicly disclosed 4. 6. 2025.

An unauthenticated remote attacker can, due to insufficient validation of SSH host keys in Nexus Dashboard Fabric Controller (NDFC), perform a MITM attack, intercept communication between NDFC and managed devices, potentially impersonate a managed device and obtain user credentials. The fixed version includes an SSH host key verification feature, which must be enabled manually after the update. More detailed information can be found at [4].

The vulnerability is present in product:

• *:Cisco Nexus Dashboard; >=3.1, <3.2(2f);

CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

More information:

• CVE-2025-20163 at cve.org, NVD
• CWE-322: Key Exchange without Entity Authentication at cwe.mitre.org

The vulnerability was publicly disclosed 4. 6. 2025.

An unauthenticated remote attacker can perform an XSS attack in the web interface of Cisco Unified Intelligent Contact Management Enterprise using social engineering [5].

The vulnerability is present in product:

• *:Cisco Unified Intelligent Contact Management Enterprise; <=15.0(1);

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

More information:

• CVE-2025-20273 at cve.org, NVD
• CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') at cwe.mitre.org

The vulnerability was publicly disclosed 4. 6. 2025.

An authenticated local attacker with administrator credentials can execute arbitrary commands with root privileges on the operating system of the vulnerable device via the CLI of certain Cisco Unified Communications products [6].

The vulnerability is present in products:

• *:Cisco Customer Collaboration Platform; <15.0(1);
• *:Cisco Finesse; <12.6(2)ES6; >=15.0, <15.0(1)
• *:Cisco Unified Communications Manager; <15SU2;
• *:Cisco Unified Communications Manager Session Management Edition; <15SU2;
• *:Cisco Unified Communications Manager IM & Presence Service; <15SU2;
• *:Cisco Unified Contact Center Express; <15.0(1);
• *:Cisco Unified Intelligence Center; <12.6(2)ES04; >=15.0, <15.0(1);
• *:Cisco Unity Connection; <15SU2;
• *:Cisco Virtualized Voice Browser; <12.6(2)ES06; >=15.0, <15.0(1);

CVSS: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

More information:

• CVE-2025-20278 at cve.org, NVD
• CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') at cwe.mitre.org

The vulnerability was publicly disclosed 4. 6. 2025.