This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] Cisco fixes 13 vulnerabilities
Cisco fixes 13 vulnerabilities in its products. The most serious of them are listed below; the remaining ones can be found at [1] by clicking on the individual advisories. Products and their fixed versions: Cisco Secure Firewall ASA Software - 9.12.4.72, 9.14.4.28 [2][3] Cisco Unified Contact Center Express - 12.5 SU3 ES07 [4][7], 15.0 ES01 [4][7] Cisco Identity Services Engine - 3.2 Patch 8 [5], 3.3 Patch 8 [5], 3.4 Patch 4 [5][6] Cisco Unified Intelligence Center - 15.0(01) ES202508 [7] The availability of a fix for Cisco Secure Firewall FTD Software can be verified using the Cisco Software Checker tool [8]. The previously reported vulnerabilities CVE-2025-20333 [2] and CVE-2025-20362 [3] in Cisco Secure ASA and Cisco Secure FTD software can now, through a newly discovered attack variant, be exploited to carry out a DoS attack.
Due to improper authentication in the Java RMI process in Unified CCX, an unauthenticated remote attacker can upload arbitrary files and execute arbitrary commands on the affected system with root privileges [4].
The vulnerability is present in product:
- Cisco Unified CCX; >=12.5 SU3, <12.5 SU3 ES07; >=15.0, <15.0 ES01
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2025-20354 at cve.org, NVD
- CWE-434: Unrestricted Upload of File with Dangerous Type at cwe.mitre.org
The vulnerability was publicly disclosed 5. 11. 2025.
Due to improper authentication in the CCX Editor application in Unified CCX, an unauthenticated remote attacker can bypass authentication and obtain administrative privileges to create and run arbitrary scripts on the underlying operating system [4].
The vulnerability is present in product:
- Cisco Unified CCX; >=12.5 SU3, <12.5 SU3 ES07; >=15.0, <15.0 ES01
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
More information:
- CVE-2025-20358 at cve.org, NVD
- CWE-306: Missing Authentication for Critical Function at cwe.mitre.org
The vulnerability was publicly disclosed 5. 11. 2025.
Due to a logic error in the processing of a RADIUS request for a MAC address already listed as a rejected endpoint, an unauthenticated remote attacker can carry out a DoS attack by sending a specific sequence of several crafted RADIUS access requests [6].
The vulnerability is present in product:
- Cisco ISE; >=3.4, <3.4 Patch 4
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H/E:X/RL:X/RC:X
More information:
- CVE-2025-20343 at cve.org, NVD
- CWE-697: Incorrect Comparison at cwe.mitre.org
The vulnerability was publicly disclosed 5. 11. 2025.
Links
- [1] https://sec.cloudapps.cisco.com/security/center/publicationListing.x
- [2] https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-webvpn-z5xP8EUB
- [3] https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-webvpn-YROOTUW
- [4] https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cc-unauth-rce-QeN8h7mQ
- [5] https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-multiple-vulns-O9BESWJH
- [6] https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-radsupress-dos-8YF3JThh
- [7] https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cc-mult-vuln-gK4TFXSn
- [8] https://sec.cloudapps.cisco.com/security/center/softwarechecker.x
By CESNET, z.s.p.o. Michaela Jarošová on 7. 11. 2025.