CVE-2025-20326
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Summary
A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM) Software and Cisco Unified CM Session Management Edition (SME) Software could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected device.
This vulnerability is due to insufficient CSRF protections for the web-based management interface on an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to click a malicious link. A successful exploit could allow the attacker to perform arbitrary actions with the privilege level of the affected user.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Cisco | Cisco Unified Communications Manager | 12.5(1)SU2 | affected |
| Cisco | Cisco Unified Communications Manager | 12.5(1)SU1 | affected |
| Cisco | Cisco Unified Communications Manager | 12.5(1) | affected |
| Cisco | Cisco Unified Communications Manager | 12.5(1)SU3 | affected |
| Cisco | Cisco Unified Communications Manager | 12.5(1)SU4 | affected |
| Cisco | Cisco Unified Communications Manager | 14 | affected |
| Cisco | Cisco Unified Communications Manager | 12.5(1)SU5 | affected |
| Cisco | Cisco Unified Communications Manager | 14SU1 | affected |
| Cisco | Cisco Unified Communications Manager | 12.5(1)SU6 | affected |
| Cisco | Cisco Unified Communications Manager | 14SU2 | affected |
| Cisco | Cisco Unified Communications Manager | 12.5(1)SU7 | affected |
| Cisco | Cisco Unified Communications Manager | 12.5(1)SU7a | affected |
| Cisco | Cisco Unified Communications Manager | 14SU3 | affected |
| Cisco | Cisco Unified Communications Manager | 12.5(1)SU8 | affected |
| Cisco | Cisco Unified Communications Manager | 12.5(1)SU8a | affected |
| Cisco | Cisco Unified Communications Manager | 15 | affected |
| Cisco | Cisco Unified Communications Manager | 15SU1 | affected |
| Cisco | Cisco Unified Communications Manager | 14SU4 | affected |
| Cisco | Cisco Unified Communications Manager | 14SU4a | affected |
| Cisco | Cisco Unified Communications Manager | 15SU1a | affected |
| Cisco | Cisco Unified Communications Manager | 12.5(1)SU9 | affected |
| Cisco | Cisco Unified Communications Manager | 15SU2 | affected |
Weaknesses
- CWE-352: Cross-Site Request Forgery (CSRF)
ADP Enrichment
CISA ADP Vulnrichment
- SSVC:
- Exploitation: none
- Automatable: no
- Technical Impact: partial
References
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.