Cisco Finesse vulnerabilities

25 CVEs affecting Cisco Finesse, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-20278, published 2025-06-04.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-44228: Apache Log4j2 Remote Code Execution Vulnerability, published 2021-12-10. Critical severity, CVSS 10.0. Actively exploited: in CISA KEV since 2021-12-10. EPSS: 100% chance of exploitation in the next 30 days. Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker…
CVE-2024-20404, published 2024-06-05. Medium severity, CVSS 5.3. EPSS: 22.6% chance of exploitation in the next 30 days. A vulnerability in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote attacker to conduct an SSRF attack on an affected system. This vulnerability is due to…
CVE-2017-12337, published 2017-11-16. Critical severity, CVSS 9.8. EPSS: 6.4% chance of exploitation in the next 30 days. A vulnerability in the upgrade mechanism of Cisco collaboration products based on the Cisco Voice Operating System software platform could allow an unauthenticated, remote attacker to gain…
CVE-2015-4310, published 2015-08-19. Medium severity, CVSS 4.3. EPSS: 2.2% chance of exploitation in the next 30 days. Multiple cross-site scripting (XSS) vulnerabilities in Cisco Finesse 10.5(1) allow remote attackers to inject arbitrary web script or HTML via unspecified parameters in a (1) GET or (2) POST request,…
CVE-2013-3457, published 2013-08-12. Medium severity, CVSS 5.0. EPSS: 2.2% chance of exploitation in the next 30 days. Absolute path traversal vulnerability in the web interface in Cisco Finesse allows remote attackers to read directory contents via a direct request to a directory URL, aka Bug ID CSCug16772.
CVE-2013-3455, published 2013-08-12. Medium severity, CVSS 5.0. EPSS: 2.1% chance of exploitation in the next 30 days. Cisco Finesse allows remote attackers to obtain sensitive information by sniffing the network for HTTP query data, aka Bug ID CSCug16732.
CVE-2018-0398, published 2018-07-18. Critical severity, CVSS 9.8. EPSS: 2% chance of exploitation in the next 30 days. Multiple vulnerabilities in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote attacker to conduct a server-side request forgery (SSRF) attack. Cisco Bug IDs:…
CVE-2017-6779, published 2018-06-07. High severity, CVSS 7.5. EPSS: 2% chance of exploitation in the next 30 days. Multiple Cisco products are affected by a vulnerability in local file management for certain system log files of Cisco collaboration products that could allow an unauthenticated, remote attacker to…
CVE-2015-0754, published 2015-05-29. High severity, CVSS 7.5. EPSS: 2% chance of exploitation in the next 30 days. Cisco Finesse 10.5(1) allows remote authenticated users to obtain sensitive information or cause a denial of service (CPU and memory consumption) via a crafted XML document, aka Bug ID CSCut95810.
CVE-2018-0399, published 2018-07-18. Critical severity, CVSS 9.8. EPSS: 1.9% chance of exploitation in the next 30 days. Multiple vulnerabilities in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote attacker to retrieve a cleartext password from an affected system. Cisco Bug…

Latest

CVE-2025-20278, published 2025-06-04. Medium severity, CVSS 6.7. EPSS: 0.2% chance of exploitation in the next 30 days. A vulnerability in the CLI of multiple Cisco Unified Communications products could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system of an…
CVE-2024-20405, published 2024-06-05. Medium severity, CVSS 6.1. EPSS: 0.6% chance of exploitation in the next 30 days. A vulnerability in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote attacker to conduct a stored XSS attack by exploiting an RFI vulnerability. This…
CVE-2023-20088, published 2023-03-03. High severity, CVSS 7.5. EPSS: 0.8% chance of exploitation in the next 30 days. A vulnerability in the nginx configurations that are provided as part of the VPN-less reverse proxy for Cisco Finesse could allow an unauthenticated, remote attacker to create a denial of service…
CVE-2021-1358, published 2021-05-22. Medium severity, CVSS 6.1. EPSS: 0.8% chance of exploitation in the next 30 days. A vulnerability in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote attacker to redirect a user to an undesired web page. This vulnerability is due to…
CVE-2021-1254, published 2021-05-22. Medium severity, CVSS 4.8. EPSS: 0.7% chance of exploitation in the next 30 days. Multiple vulnerabilities in the web-based management interface of Cisco Finesse could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the…
CVE-2021-1246, published 2021-01-13. Medium severity, CVSS 6.1. EPSS: 1.4% chance of exploitation in the next 30 days. Cisco Finesse, Cisco Virtualized Voice Browser, and Cisco Unified CVP OpenSocial Gadget Editor Unauthenticated Access Vulnerability A vulnerability in the web management interface of Cisco…
CVE-2021-1245, published 2021-01-13. Medium severity, CVSS 6.1. EPSS: 1.4% chance of exploitation in the next 30 days. Cisco Finesse and Cisco Unified CVP OpenSocial Gadget Editor Cross-Site Scripting Vulnerability A vulnerability in the web-based management interface of Cisco Finesse and Cisco Unified CVP could…
CVE-2020-3159, published 2020-02-19. Medium severity, CVSS 6.1. EPSS: 0.8% chance of exploitation in the next 30 days. A vulnerability in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based…