CVE-2025-20317: high-severity vulnerability in Cisco Unified Computing System E-Series…
Cisco UCS Virtual Keyboard Video Monitor (vKVM) Open Redirect Vulnerability
Published
Follow this CVE+ Monitor Cisco Unified Computing System+ Monitor Cisco Unified Computing System E-Series
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.1epss 0.4%
A vulnerability in the Virtual Keyboard Video Monitor (vKVM) connection handling of Cisco Integrated Management Controller (IMC) could allow an unauthenticated, remote attacker to redirect a user to a malicious website.
This vulnerability is due to insufficient verification of vKVM endpoints. An attacker could exploit this vulnerability by persuading a user to click a crafted link. A successful exploit could allow the attacker to redirect a user to a malicious webpage and potentially capture user credentials.
Note: The affected vKVM client is also included in Cisco UCS Manager.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N
Affected products
Cisco · Cisco Unified Computing System E-Series Software (UCSE)Cisco · Cisco Unified Computing System (Managed)Cisco · Cisco Unified Computing System (Standalone)Related CVEs — Cisco Unified Computing System E-Series…
In the same product, most dangerous first.
CVE-2024-20356HIGHCVE-2024-20356EPSS 29.6%CVE-2020-3470CRITICALCisco Integrated Management Controller Multiple Remote Code Execution VulnerabilitiesEPSS 4.8%CVE-2020-3119HIGHCisco NX-OS Software Cisco Discovery Protocol Remote Code Execution VulnerabilityEPSS 4.8%CVE-2018-0430—Cisco Integrated Management Controller Command Injection VulnerabilityEPSS 4.0%CVE-2018-0431—Cisco Integrated Management Controller Command Injection VulnerabilityEPSS 4.0%CVE-2026-76455CRITICALCisco NX-OS Software Security Hardening Release: October 2026 - Improper Access Control VulnerabilitiesEPSS 4.0%