CVE-2025-20278: Cisco Finesse

Medium severity, CVSS 6.7. EPSS: 0.2% chance of exploitation in the next 30 days.

A vulnerability in the CLI of multiple Cisco Unified Communications products could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system of an affected device as the root user. This vulnerability is due to improper validation of user-supplied command arguments. An attacker could exploit this vulnerability by executing crafted commands on the CLI of an affected device. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system of an affected device as the root user. To exploit this vulnerability, the attacker must have valid administrative credentials.

Affected products

  • Cisco Finesse: version 10.5(1) only; version 10.5(1)_es1 only; version 10.5(1)_es2 only; version 10.5(1)_es3 only; version 10.5(1)_es4 only; version 10.5(1)_es5 only; …
  • Cisco Socialminer: version 10.5(1) only; version 10.6(1) only; version 10.6(2) only; version 11.0(1) only; version 11.5(1) only; version 11.5(1)su1 only; …
  • Cisco Unified Communications Manager: version 12.5(1) only; version 12.5(1)su1 only; version 12.5(1)su2 only; version 12.5(1)su3 only; version 12.5(1)su4 only; version 12.5(1)su5 only; …
  • Cisco Unified Communications Manager Im And Presence Service: version 12.5(1) only; version 12.5(1)su1 only; version 12.5(1)su2 only; version 12.5(1)su3 only; version 12.5(1)su4 only; version 12.5(1)su5 only; …
  • Cisco Unified Contact Center Express: version 8.5(1) only; version 9.0(2)su3es04 only; version 10.0(1)su1 only; version 10.0(1)su1es04 only; version 10.5(1) only; version 10.5(1)su1 only; …
  • Cisco Unified Intelligence Center: before 12.6\(2\)es_04 (fixed in 12.6\(2\)es_04)
  • Cisco Unity Connection: version 12.5(1) only; version 12.5(1)su1 only; version 12.5(1)su2 only; version 12.5(1)su3 only; version 12.5(1)su4 only; version 12.5(1)su5 only; …
  • Cisco Virtualized Voice Browser: before 12.6\(2\)es06 (fixed in 12.6\(2\)es06)

Published 2025-06-04. Last modified 2026-06-17.