CVE-2025-20326

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM) Software and Cisco Unified CM Session Management Edition (SME) Software could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected device. This vulnerability is due to insufficient CSRF protections for the web-based management interface on an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to click a malicious link. A successful exploit could allow the attacker to perform arbitrary actions with the privilege level of the affected user.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-352

Affected software

VendorProductVersions
CiscoCisco Unified Communications Manager12.5(1)SU2; 12.5(1)SU1; 12.5(1); 12.5(1)SU3; 12.5(1)SU4; 14; 12.5(1)SU5; 14SU1; 12.5(1)SU6; 14SU2; 12.5(1)SU7; 12.5(1)SU7a; 14SU3; 12.5(1)SU8; 12.5(1)SU8a; 15; 15SU1; 14SU4; 14SU4a; 15SU1a

References

Timeline

Published
Sep 3, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-203277.7A vulnerability in the web UI of Cisco IOS Software could allow an authenticated, remote attacker with low privileges to cause a denial of sCVE-2025-203285.4A vulnerability in the user profile component of Cisco Webex Meetings could have allowed an authenticated, remote attacker with low privilegCVE-2025-203294.9A vulnerability in the logging component of Cisco TelePresence Collaboration Endpoint (CE) and Cisco RoomOS Software could allow an authentiCVE-2025-20338.8A vulnerability, which was classified as critical, was found in code-projects Blood Bank Management System 1.0. Affected is an unknown functCVE-2025-203306.1A vulnerability in the web-based management interface of Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&PCVE-2025-203315.4A vulnerability in the web-based management interface of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to conducCVE-2025-203324.3A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to modify parts of the confCVE-2025-203339.9A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat DCVE-2025-203348.8A vulnerability in the HTTP API subsystem of Cisco IOS XE Software could allow a remote attacker to inject commands that will execute with rCVE-2025-203355.3A vulnerability in the directory permissions of Cisco Desk Phone 9800 Series, Cisco IP Phone 7800 and 8800 Series, and Cisco Video Phone 887CVE-2025-203367.5A vulnerability in the directory permissions of Cisco Desk Phone 9800 Series, Cisco IP Phone 7800 and 8800 Series, and Cisco Video Phone 887CVE-2025-2033710.0A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to execute arbitrary code o
CVE-2025-20326: High severity, CVSS 8.8 | Vulnix