CVE-2025-20112: Cisco Emergency Responder

Medium severity, CVSS 5.1. EPSS: 0.1% chance of exploitation in the next 30 days.

A vulnerability in multiple Cisco Unified Communications and Contact Center Solutions products could allow an authenticated, local attacker to elevate privileges to root on an affected device. This vulnerability is due to excessive permissions that have been assigned to system commands. An attacker could exploit this vulnerability by executing crafted commands on the underlying operating system. A successful exploit could allow the attacker to escape the restricted shell and gain root privileges on the underlying operating system of an affected device. To successfully exploit this vulnerability, an attacker would need administrative access to the ESXi hypervisor.

Affected products

Cisco Cisco Emergency Responder: version 12.5(1a) only; version 12.5(1)SU1 only; version 12.5(1) only; version 12.5(1)SU2 only; version 12.5(1)SU3 only; version 12.5(1)SU4 only; …
Cisco Cisco Finesse: version 11.0(1)ES_Rollback only; version 10.5(1)ES4 only; version 11.6(1)ES3 only; version 11.0(1)ES2 only; version 12.0(1)ES2 only; version 10.5(1)ES3 only; …
Cisco Cisco Prime Collaboration Deployment: version 11.5(1) only; version 11.0(1a) only; version 11.5(1)SU1 only; version 10.5(3) only; version 12.6(1) only; version 11.0(1) only; …
Cisco Cisco Socialminer: version 12.5(1)ES01 only; version 10.5(1) only; version 11.6(1) only; version 10.6(1) only; version 12.0(1)ES04 only; version 10.6(2) only; …
Cisco Cisco Unified Communications Manager: version 12.5(1)SU2 only; version 12.5(1)SU1 only; version 12.5(1) only; version 12.5(1)SU3 only; version 12.5(1)SU4 only; version 14 only; …
Cisco Cisco Unified Communications Manager Im And Presence Service: version 12.5(1) only; version 12.5(1)SU1 only; version 12.5(1)SU2 only; version 12.5(1)SU3 only; version 12.5(1)SU4 only; version 14 only; …
Cisco Cisco Unified Contact Center Express: version 10.5(1)SU1 only; version 10.6(1) only; version 11.6(1) only; version 10.6(1)SU1 only; version 10.6(1)SU3 only; version 11.6(2) only; …
Cisco Cisco Unified Intelligence Center: version 11.6(1) only; version 10.5(1) only; version 11.0(1) only; version 11.5(1) only; version 12.0(1) only; version 12.5(1) only; …
Cisco Cisco Unity Connection: version 12.5(1) only; version 12.5(1)SU1 only; version 12.5(1)SU2 only; version 12.5(1)SU3 only; version 12.5(1)SU4 only; version 14 only; …
Cisco Cisco Virtualized Voice Browser: version 11.0(1) only; version 11.6(1)_ES84 only; version 11.5(1)_ES54 only; version 11.5(1)_ES27 only; version 11.5(1) only; version 11.5(1)ES36 only; …

Published 2025-05-21. Last modified 2026-06-17.