Authentication Bypass Vulnerability in Cisco Unified Contact Center Express Editor

CVE-2025-20358

What is CVE-2025-20358?

A vulnerability exists in the Contact Center Express (CCX) Editor application of Cisco Unified CCX that allows an unauthenticated remote attacker to bypass authentication controls. This flaw stems from inadequate authentication mechanisms in the communication between the CCX Editor and the Unified CCX server. Exploitation of this vulnerability can enable attackers to redirect authentication flows to malicious servers, thus deceiving the CCX Editor into unauthorized access. A successful attack grants attackers administrative permissions to create and execute arbitrary scripts on the affected Unified CCX server as an internal non-root user account, creating significant security risks.

References