Cross-Site Scripting Flaw in Cisco Unified Communications Manager IM & Presence Service
CVE-2025-20330

6.1MEDIUM

Key Information:

Vendor

Cisco
Status
Cisco Unified Communications Manager Im And Presence Service
Vendor
CVE Published:
3 September 2025

Badges

👾 Exploit Exists

What is CVE-2025-20330?

A vulnerability exists within the web-based management interface of Cisco Unified Communications Manager IM & Presence Service, allowing remote attackers to launch cross-site scripting (XSS) attacks. The weakness stems from inadequate validation of user-supplied input, enabling attackers to exploit it by enticing users to click on malicious links. Successful exploitation may result in unauthorized execution of script code in the affected interface or compromise sensitive information stored in the user's browser.

Affected Version(s)

Cisco Unified Communications Manager IM and Presence Service 12.5(1)

Cisco Unified Communications Manager IM and Presence Service 12.5(1)SU1

Cisco Unified Communications Manager IM and Presence Service 12.5(1)SU2

References

https://sec.cloudapps.cisco.com/security/center/content/C...

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-20330 : Cross-Site Scripting Flaw in Cisco Unified Communications Manager IM & Presence Service