This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] Cisco fixes 10 vulnerabilities

Cisco fixes 10 vulnerabilities in various products, the most severe of which are described below. The remaining ones, including the list of vulnerable products and available fixes, can be found at [1] by clicking through the individual advisories.

Cisco Secure Firewall Adaptive Security Appliance (ASA) & Secure Firewall Threat Defense (FTD) Software - DoS (CVE-2025-20127)
CVSS 7.7 (High)

If the TLS_CHACHA20_POLY1305_SHA256 cipher for TLS 1.3 is enabled in Cisco Secure Firewall ASA and Cisco Secure FTD on Firepower 3100/4200 Series platforms (with an SSL listen socket), an authenticated remote attacker can carry out a DoS attack by sending a large number of TLS 1.3 connections, after which the device stops accepting new encrypted connections (SSL/TLS and VPN). Operation can be restored only by restarting the device. Details of the vulnerability and mitigation options can be found at [2].

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

More information:

The vulnerability was publicly disclosed 14. 8. 2025.

Cisco Unified Communications Manager IM & Presence Service - XSS (CVE-2025-20330)
CVSS 6.1 (Medium)

Due to insufficient validation of user input in the web interface of Cisco Unified Communications Manager IM & Presence Service, an unauthenticated remote attacker can carry out an XSS attack [3].

The vulnerability is present in product:

  • Cisco Unified Communications Manager IM & Presence Service; >=12.5, <=12.5(1)SU9; >=14, <=14SU4a; >=15, <15SU3;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

More information:

  • CVE-2025-20330 at cve.org, NVD
  • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') at cwe.mitre.org

The vulnerability was publicly disclosed 3. 9. 2025.

Cisco Webex Meetings - XSS (CVE-2025-20328)
CVSS 5.4 (Medium)

Due to insufficient validation of user input in the Cisco Webex Meetings component, an authenticated remote attacker can carry out an XSS attack [4]. The vulnerability was fixed directly in the cloud service and requires no action on the part of the user.

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

More information:

  • CVE-2025-20328 at cve.org, NVD
  • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') at cwe.mitre.org

The vulnerability was publicly disclosed 3. 9. 2025.

By CESNET, z.s.p.o. Michaela Ručková on 8. 9. 2025.

CESNET, z.s.p.o. Logo