CVE-2025-20278

Name: CVE-2025-20278
Creator: NVD / NIST
Published: 2025-06-04T17:15:27.963+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

MEDIUMCVSS 6.7/10EPSS 0.16%

Last modified Jun 17, 2026

CVE-2025-20278 is a medium-severity vulnerability rated 6.7/10 on the CVSS scale. A vulnerability in the CLI of multiple Cisco Unified Communications products could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system of an affected device as the root user. This vulnerability is due to improper validation of user-supplied command arguments. An attacker could exploit this vulnerability by executing crafted commands on the CLI of an affected device. EPSS estimates a 0.16% chance of exploitation in the next 30 days.

Description

A vulnerability in the CLI of multiple Cisco Unified Communications products could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system of an affected device as the root user. This vulnerability is due to improper validation of user-supplied command arguments. An attacker could exploit this vulnerability by executing crafted commands on the CLI of an affected device. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system of an affected device as the root user. To exploit this vulnerability, the attacker must have valid administrative credentials.

Metrics

CVSS 3.1

6.7/10

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS Probability

0.16%

5.1th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-77

Affected Software

Vendor	Product	Versions
Cisco	Finesse	10.5\(1\)
Cisco	Finesse	10.5\(1\)_es1
Cisco	Finesse	10.5\(1\)_es2
Cisco	Finesse	10.5\(1\)_es3
Cisco	Finesse	10.5\(1\)_es4
Cisco	Finesse	10.5\(1\)_es5
Cisco	Finesse	10.5\(1\)_es6
Cisco	Finesse	10.5\(1\)_es7
Cisco	Finesse	10.5\(1\)_es8
Cisco	Finesse	10.5\(1\)_es9
Cisco	Finesse	10.5\(1\)_es10
Cisco	Finesse	11.0\(1\)
Cisco	Finesse	11.5\(1\)
Cisco	Finesse	11.6\(1\)
Cisco	Finesse	11.6\(1\)_fips
Cisco	Finesse	12.0\(1\)
Cisco	Finesse	12.5\(1\)
Cisco	Finesse	12.5\(2\)
Cisco	Finesse	12.6\(1\)
Cisco	Finesse	12.6\(2\)
Cisco	Socialminer	10.5\(1\)
Cisco	Socialminer	10.6\(1\)
Cisco	Socialminer	10.6\(2\)
Cisco	Socialminer	11.0\(1\)
Cisco	Socialminer	11.5\(1\)
Cisco	Socialminer	11.5\(1\)su1
Cisco	Socialminer	11.6\(1\)
Cisco	Socialminer	11.6\(2\)
Cisco	Socialminer	12.0\(1\)
Cisco	Socialminer	12.0\(1\)es02
Cisco	Socialminer	12.0\(1\)es03
Cisco	Socialminer	12.0\(1\)es04
Cisco	Socialminer	12.5\(1\)
Cisco	Socialminer	12.5\(1\)es01
Cisco	Socialminer	12.5\(1\)su1
Cisco	Socialminer	12.5\(1\)su2
Cisco	Socialminer	12.5\(1\)su3
Cisco	Unified Communications Manager	12.5\(1\)
Cisco	Unified Communications Manager	12.5\(1\)su1
Cisco	Unified Communications Manager	12.5\(1\)su2
Cisco	Unified Communications Manager	12.5\(1\)su3
Cisco	Unified Communications Manager	12.5\(1\)su4
Cisco	Unified Communications Manager	12.5\(1\)su5
Cisco	Unified Communications Manager	12.5\(1\)su6
Cisco	Unified Communications Manager	12.5\(1\)su7
Cisco	Unified Communications Manager	12.5\(1\)su7a
Cisco	Unified Communications Manager	12.5\(1\)su8
Cisco	Unified Communications Manager	12.5\(1\)su8a
Cisco	Unified Communications Manager	12.5\(1\)su9
Cisco	Unified Communications Manager Im And Presence Service	12.5\(1\)

Showing 50 of 132 affected configurations. See NVD for the full list.

References

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vos-command-inject-65s2UCYyVendor Advisory

Timeline

Published: Jun 4, 2025
Last Modified: Jun 17, 2026
Status: Analyzed

Frequently Asked Questions

What is CVE-2025-20278?

How severe is CVE-2025-20278?

CVE-2025-20278 has a CVSS score of 6.7/10 (MEDIUM severity). The EPSS model estimates a 0.16% probability of exploitation in the next 30 days.

How do I fix CVE-2025-20278?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2025-20278?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST