CVE-2025-20326

Description

A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM) Software and Cisco Unified CM Session Management Edition (SME) Software could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected device. This vulnerability is due to insufficient CSRF protections for the web-based management interface on an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to click a malicious link. A successful exploit could allow the attacker to perform arbitrary actions with the privilege level of the affected user.

PUBLISHED Reserved 2024-10-10 | Published 2025-09-03 | Updated 2025-09-03 | Assigner cisco

Problem types

Cross-Site Request Forgery (CSRF)

Product status

References

sec.cloudapps.cisco.com/...isory/cisco-sa-cucm-csrf-w762pRYd (cisco-sa-cucm-csrf-w762pRYd)

cve.org (CVE-2025-20326)

nvd.nist.gov (CVE-2025-20326)

Download JSON