CVE-2025-20112: medium-severity vulnerability in Cisco Emergency Responder
Cisco Unified Communications Products Privilege Escalation Vulnerability
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.1epss 0.1%
A vulnerability in multiple Cisco Unified Communications and Contact Center Solutions products could allow an authenticated, local attacker to elevate privileges to root on an affected device.
This vulnerability is due to excessive permissions that have been assigned to system commands. An attacker could exploit this vulnerability by executing crafted commands on the underlying operating system. A successful exploit could allow the attacker to escape the restricted shell and gain root privileges on the underlying operating system of an affected device. To successfully exploit this vulnerability, an attacker would need administrative access to the ESXi hypervisor.
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N
Affected products
Cisco · Cisco Emergency ResponderCisco · Cisco FinesseCisco · Cisco Prime Collaboration DeploymentCisco · Cisco SocialMinerCisco · Cisco Unified Communications ManagerCisco · Cisco Unified Communications Manager IM and Presence ServiceCisco · Cisco Unified Contact Center ExpressCisco · Cisco Unified Intelligence CenterCisco · Cisco Unity ConnectionCisco · Cisco Virtualized Voice BrowserRelated CVEs — Cisco Emergency Responder
In the same product, most dangerous first.
CVE-2024-20404HIGHCVE-2024-20404EPSS 22.6%CVE-2023-20101CRITICALCVE-2023-20101EPSS 2.6%CVE-2019-12632MEDIUMCisco Finesse Request Processing Server-Side Request Forgery VulnerabilityEPSS 1.6%CVE-2024-20352MEDIUMCVE-2024-20352EPSS 1.5%CVE-2018-15403—Multiple Cisco Unified Communications Products Open Redirect VulnerabilityEPSS 1.2%CVE-2021-1226MEDIUMCisco Unified Communications Products Information Disclosure VulnerabilityEPSS 0.9%