Cisco fixes critical UCCX flaw allowing Root command execution

Cisco has patched a critical flaw in its Unified Contact Center Express (UCCX) software that could let an unauthenticated remote attacker execute commands with root privileges, tracked as CVE-2025-20354 (CVSS 9.8). The vulnerability stems from the Java Remote Method Invocation process, allowing an attacker to upload arbitrary files and run commands via the RMI interface, with improper authentication tied to certain CCX features.

According to Cisco Security Advisory, the root cause lies in authentication gaps that permit crafted input to be processed by the RMI endpoint, enabling arbitrary command execution and elevation to root on the affected system; Cisco notes there are no workarounds. Cisco has released fixes across multiple UCCX releases: first fixed releases include 12.5 SU3 and ES07 for 12.5, and 15.0 and 15.0 ES01 for 15.0.

The firm also states there are no indications of attacks in the wild exploiting this vulnerability at present, and the advisory provides guidance on updating to the fixed releases. November 07, 2025.