Medium severity · published May 21, 2025
CVE-2025-20112
Cisco Unified Communications Products Privilege Escalation Vulnerability
5.1
CVSS
0.1%
EPSS
No
On KEV
Description
A vulnerability in multiple Cisco Unified Communications and Contact Center Solutions products could allow an authenticated, local attacker to elevate privileges to root on an affected device. This vulnerability is due to excessive permissions that have been assigned to system commands. An attacker could exploit this vulnerability by executing crafted commands on the underlying operating system. A successful exploit could allow the attacker to escape the restricted shell and gain root privileges on the underlying operating system of an affected device. To successfully exploit this vulnerability, an attacker would need administrative access to the ESXi hypervisor.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N
Attack vector
Local
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
Low
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 4% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CE
Cisco Emergency Responder · Cisco
12.5(1a); 12.5(1)SU1; 12.5(1); 12.5(1)SU2; 12.5(1)SU3; 12.5(1)SU4; +16 more · source: vendor
CF
Cisco Finesse · Cisco
11.0(1)ES_Rollback; 10.5(1)ES4; 11.6(1)ES3; 11.0(1)ES2; 12.0(1)ES2; 10.5(1)ES3; +34 more · source: vendor
CP
Cisco Prime Collaboration Deployment · Cisco
11.5(1); 11.0(1a); 11.5(1)SU1; 10.5(3); 12.6(1); 11.0(1); +17 more · source: vendor
CS
Cisco SocialMiner · Cisco
12.5(1)ES01; 10.5(1); 11.6(1); 10.6(1); 12.0(1)ES04; 10.6(2); +11 more · source: vendor
CU
Cisco Unified Communications Manager · Cisco
12.5(1)SU2; 12.5(1)SU1; 12.5(1); 12.5(1)SU3; 12.5(1)SU4; 14; +15 more · source: vendor
CU
Cisco Unified Communications Manager IM and Presence Service · Cisco
12.5(1); 12.5(1)SU1; 12.5(1)SU2; 12.5(1)SU3; 12.5(1)SU4; 14; +12 more · source: vendor
CU
Cisco Unified Contact Center Express · Cisco
10.5(1)SU1; 10.6(1); 11.6(1); 10.6(1)SU1; 10.6(1)SU3; 11.6(2); +34 more · source: vendor
CU
Cisco Unified Intelligence Center · Cisco
11.6(1); 10.5(1); 11.0(1); 11.5(1); 12.0(1); 12.5(1); +16 more · source: vendor
CU
Cisco Unity Connection · Cisco
12.5(1); 12.5(1)SU1; 12.5(1)SU2; 12.5(1)SU3; 12.5(1)SU4; 14; +13 more · source: vendor
CV
Cisco Virtualized Voice Browser · Cisco
11.0(1); 11.6(1)_ES84; 11.5(1)_ES54; 11.5(1)_ES27; 11.5(1); 11.5(1)ES36; +34 more · source: vendor
Affected product
CE
Cisco Emergency Responder
Cisco
More from Cisco Emergency Responder
9.8
CVE-2026-76474
Cisco Unified Communications Products Hardening Release: October 2026 - Improper Authentication Vulnerabilities
9.8
CVE-2026-76473
Cisco Unified Communications Products Hardening Release: October 2026 - Improper control of a resource through its lifetime.
9.3
CVE-2026-76475
Cisco Unified Communications Products Hardening Release: October 2026 - Cross-site Scripting Vulnerabilities
8.8
CVE-2026-76478
Cisco Unified Communications Products Hardening Release: October 2026 - Improper Access Control Vulnerabilities
8.8
CVE-2026-76476
Cisco Unified Communications Products Hardening Release: October 2026 - Improper Input Validation Vulnerabilities