External risk intelligence

Cisco Unified CCX RMI Unauthenticated Remote Code Execution and Privilege Escalation.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-20354

The vulnerability involves Java RMI in Cisco Unified Contact Center Express. While this product is often deployed in internal enterprise environments to manage contact center operations, RMI services are sometimes inadvertently exposed or accessible within broader corporate networks, making remote reachability possible depending on specific network configuration and segmentation.

Unrestricted File Upload

Cisco Unified Contact Center Express

before 12.5\(1\)_su03_es0715.0

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in Cisco Unified Contact Center Express, stemming from flawed authentication in its Java RMI process. This flaw could enable an attacker to upload files and execute commands with the highest system privileges, impacting the core functionality of the contact center infrastructure.

Unauthenticated attackers can remotely gain root access.
Protects critical customer interaction systems.
Confirm product relevance and assess exposure.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker could exploit this vulnerability by sending specially crafted files through the Java RMI process. This could lead to the execution of arbitrary commands with root privileges on the affected system.

No authentication required.
Upload crafted files via RMI.
Execute commands and gain root access.

Live Threat

Current exploitation, exposure, and threat context

An unauthenticated, remote attacker could upload arbitrary files and execute arbitrary commands with root permissions on an affected Cisco Unified CCX system when supported by the advisory. This is due to improper authentication for specific Cisco Unified CCX features.

System control and data access.
Uploading a crafted file via Java RMI.
Full system compromise and data exfiltration.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in Cisco Unified Contact Center Express requires immediate attention from teams managing Cisco contact center infrastructure and security. The first practical step is to identify all instances of the affected product, confirm their network exposure and business criticality, and then assign ownership for remediation.

Own by infrastructure and security teams.
Verify network exposure and criticality.
Plan remediation with Cisco.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Cisco Unified Contact Center Express?

It is an enterprise software platform designed to manage customer interactions, such as voice, email, and chat, within contact centers. It automates routing and reporting for these communications. In this context, the software relies on Java Remote Method Invocation (RMI) to facilitate communication between different parts of the system, which is the specific component affected by the identified vulnerability.

What is the nature of the CVE-2025-20354 vulnerability?

This vulnerability is classified as CWE-434, which refers to Unrestricted Upload of File with Dangerous Type. In plain terms, the system fails to properly check the identity or authorization of those connecting to its RMI process. This flaw allows a remote attacker to upload malicious files without needing a login, subsequently enabling them to run commands that take full control of the operating system with root-level privileges.

How can an attacker trigger this vulnerability?

An attacker initiates the process by connecting to the Cisco Unified CCX system via the Java RMI interface. Because authentication is bypassed, they can send a crafted file to the application. It is important to note that this bug specifically requires the RMI process to be reachable; it cannot be triggered if the service is entirely isolated from the network or if the specific Cisco features utilizing the flawed RMI authentication are disabled.

Is my organization vulnerable according to Halo Surface Signal?

Halo Surface Signal identifies this as a potential risk because, while Cisco Unified CCX is typically an internal tool, RMI services can sometimes be exposed across broader corporate network segments. You should evaluate if your network architecture allows access to these RMI interfaces. Even if the system is not directly on the public internet, it may be reachable from within your internal network, which still presents a significant security risk.

What should I do if I run this technology?

Begin by creating an inventory of all instances of Cisco Unified Contact Center Express in your environment to determine which versions are running. Once identified, verify their current network configuration to understand their accessibility. After assessing your footprint, coordinate with your infrastructure and security teams to review official Cisco guidance and plan for the necessary updates or patches to secure your systems.

References

sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-s…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.