This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] Cisco fixes 5 vulnerabilities

Cisco fixes 5 vulnerabilities in various products. Products and their fixed versions: Cisco Cyber Vision Center - 5.3 [1] Cisco Unified Communications Manager - 15SU3 [2] Cisco Unified Communications Manager Session Management Edition - 15SU3 [2] The availability of a fix for Cisco IOS and IOS XE Software can be verified using the Cisco Software Checker tool [3].

Cisco IOS, IOS XE - DoS (CVE-2025-20352)
CVSS 7.7 (High)

Allows an authenticated remote attacker to perform a DoS attack due to a stack overflow vulnerability in the SNMP subsystem of Cisco IOS and Cisco IOS XE Software [4].

The vulnerability is present in products:

  • Cisco IOS;
  • Cisco IOS XE;

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H/E:X/RL:X/RC:X

More information:

The vulnerability was publicly disclosed 30. 9. 2025.

Cisco IOS XE - DoS (CVE-2025-20311)
CVSS 7.4 (High)

Allows an unauthenticated attacker on the local network to perform a DoS attack in Cisco IOS XE Software for Catalyst 9000 Series switches by means of specially crafted Ethernet frames [5].

The vulnerability is present in product:

  • Cisco IOS XE;

CVSS: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H/E:X/RL:X/RC:X

More information:

The vulnerability was publicly disclosed 30. 9. 2025.

Cisco Cyber Vision Center - stored XSS (CVE-2025-20356, CVE-2025-20357)
CVSS 5.4 (Medium)

Allows an authenticated remote attacker to perform an XSS attack in Cisco Cyber Vision Center due to insufficient validation of user input in the web interface. Exploiting the vulnerability requires administrator access to the Sensor Explorer page for CVE-2025-20356 or to the Reports page for CVE-2025-20357 [1].

The vulnerability is present in product:

  • Cisco Cyber Vision Center; >5.0, <=5.2

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:X/RL:X/RC:X

More information:

The vulnerability was publicly disclosed 1. 10. 2025.

Cisco Unified Communications Manager and Unified Communications Manager Session Management Edition - stored XSS (CVE-2025-20361)
CVSS 4.8 (Medium)

Allows an authenticated remote attacker with valid administrator credentials to perform an XSS attack due to insufficient validation of user input in the web interface of Cisco Unified Communications Manager and Unified Communications Manager Session Management Edition [2].

The vulnerability is present in products:

  • Cisco Unified Communications Manager; >=12.5, <15SU3
  • Cisco Unified Communications Manager Session Management Edition; >=12.5, <15SU3

CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N/E:X/RL:X/RC:X

More information:

  • CVE-2025-20361 at cve.org, NVD
  • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') at cwe.mitre.org

The vulnerability was publicly disclosed 1. 10. 2025.

By CESNET, z.s.p.o. Michaela Jarošová on 2. 10. 2025.

CESNET, z.s.p.o. Logo