Cisco IMC Virtual Keyboard Vulnerability Allows Attackers to Redirect Users to Malicious Websites

Cisco has released urgent security updates to remediate a high-severity vulnerability in its Integrated Management Controller (IMC) virtual keyboard video monitor (vKVM) module that could allow unauthenticated, remote attackers to hijack sessions and redirect users to malicious websites. The flaw, tracked as CVE-2025-20317, carries a CVSS base score of 7.1 and affects a wide range of Cisco UCS servers, appliances, and Catalyst uCPE platforms.

Exploitation requires no authentication and can be delivered via email or chat with a malicious URL, with redirects occurring inside the trusted IMC management session so victims may not realise they have left the legitimate interface. Once redirected, attackers can deploy phishing pages mimicking Cisco login prompts to capture administrator credentials or session tokens.

No workarounds exist, and Cisco recommends prompt patching through normal channels; several affected platforms are listed, including Catalyst 8300 Series Edge uCPE and UCS server families. According to Cisco’s Product Security Incident Response Team (PSIRT), there is no active exploitation or public announcements related to the vulnerability as of the advisory publication on 27 August 2025.