Introduction
An attacker can gain administrative script execution on Cisco Unified Contact Center Express (CCX) servers without authenticating, which puts customer workflows and data at risk. The vulnerability allows remote code execution through the CCX Editor, the tool used to manage contact center call flows in thousands of enterprise deployments worldwide.
About Cisco Unified CCX: Cisco is a major networking and communications vendor with a dominant position in enterprise infrastructure. Unified CCX is a widely adopted contact center platform that organizations of all sizes use to manage customer interactions, so a vulnerability in it has a large impact across sectors.
Technical information
CVE-2025-20358 is caused by missing authentication for critical functions (CWE-306) in the protocol between the Cisco Unified CCX Editor and the Unified CCX server. When a user launches the CCX Editor and starts authentication, the client sends credentials and requests to the configured server. The editor does not adequately verify that the responding server is the legitimate Unified CCX server. Without mutual authentication, an attacker can use techniques such as DNS poisoning or man-in-the-middle attacks to redirect the authentication flow to a malicious server they control.
Once the CCX Editor connects to the attacker's server, the attacker can send responses that convince the editor that authentication succeeded. The editor then grants administrative permissions for script creation and execution. Scripts created this way run on the Unified CCX server as an internal non-root user. That gives the attacker a foothold for further compromise, which, depending on the environment, may include privilege escalation or lateral movement.
As of the disclosure date, no public code snippets or protocol diagrams are available for this vulnerability.
Affected systems and versions
- Cisco Unified Contact Center Express (CCX) Editor application
- The public advisory does not list specific affected version numbers as of the disclosure date
- The vulnerability is present in configurations where the CCX Editor communicates with the Unified CCX server and relies on the default authentication mechanism
Vendor security history
Cisco has disclosed multiple critical vulnerabilities in its enterprise product lines in 2025, including:
- CVE-2025-20333, CVE-2025-20362, and CVE-2025-20363 in Secure Firewall products (with evidence of active exploitation)
- CVE-2025-20275 and CVE-2025-20276 in Unified CCX and related platforms
- CVE-2025-20354 and CVE-2025-20355 in Unified CCX
Cisco typically issues coordinated advisories and patches. Even so, the repeated critical flaws point to ongoing difficulty with secure development and testing in complex enterprise systems.
