Introduction
Remote attackers can gain root access to Cisco Unified Contact Center Express (CCX) systems without credentials or user interaction. Through the Java RMI process, they can upload arbitrary files and execute commands, which puts the security of enterprise contact center infrastructure directly at risk. Organizations worldwide use Cisco Unified CCX to manage customer interactions, and the platform is widely deployed, so any enterprise running Cisco's contact center solutions should pay attention to this issue.
Technical Information
CVE-2025-20354 is caused by improper authentication in the Java Remote Method Invocation (RMI) process within Cisco Unified CCX. The RMI interface, typically exposed on TCP port 1099, handles inter-process communication in the CCX architecture. Specific RMI endpoints do not enforce authentication, so an unauthenticated remote attacker can send crafted RMI requests that invoke file upload functionality.
The vulnerability is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type). Attackers can upload arbitrary files to the affected system, and the system then executes those files with root privileges. The result is full remote code execution on the underlying operating system. The attack needs only network access to the vulnerable RMI interface. No credentials or user interaction are required. Because the flaw sits in the core communication mechanism of CCX, exploitation is straightforward for anyone with network visibility to the RMI service.
No public code snippets or proof of concept are available as of the advisory date. The vulnerability depends on no specific configuration beyond an exposed and unpatched RMI interface on a vulnerable CCX version.
Affected Systems and Versions
CVE-2025-20354 affects multiple major versions of Cisco Unified Contact Center Express (Unified CCX). The official Cisco advisory confirms the following:
- Cisco Unified CCX versions prior to the fixed releases listed in the advisory are vulnerable.
- The vulnerability is present in default deployments where the Java RMI process is enabled and accessible.
- Other Cisco contact center products such as Packaged CCE and Unified CCE are not affected by this specific issue.
Organizations must check the Cisco advisory (see references) for the exact affected and fixed version numbers, because these may vary by deployment and release track.
Vendor Security History
Cisco has had several critical vulnerabilities in its unified communications and infrastructure products in 2025. Recent examples include unauthenticated remote code execution in Cisco Identity Services Engine (CVSS 10.0) and static SSH credential flaws in Unified Communications Manager. Cisco's PSIRT typically responds with advisories and patches, but the frequency and severity of recent disclosures point to ongoing architectural and security problems in Cisco's enterprise product lines.
