Cisco Emergency Responder privilege chaining

Summaryinfo

A vulnerability categorized as problematic has been discovered in Cisco Emergency Responder, Finesse, Prime Collaboration Deployment, SocialMiner, Unified Communications Manager, Unified Communications Manager IM and Presence Service, Unified Contact Center Express, Unified Intelligence Center, Unity Connection and Virtualized Voice Browser. This vulnerability affects unknown code. Such manipulation leads to privilege chaining. This vulnerability is traded as CVE-2025-20112. An attack has to be approached locally. There is no exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in Cisco Emergency Responder, Finesse, Prime Collaboration Deployment, SocialMiner, Unified Communications Manager, Unified Communications Manager IM and Presence Service, Unified Contact Center Express, Unified Intelligence Center, Unity Connection and Virtualized Voice Browser and classified as problematic. Affected by this issue is an unknown functionality. The manipulation with an unknown input leads to a privilege chaining vulnerability. Using CWE to declare the problem leads to CWE-268. Two distinct privileges, roles, capabilities, or rights can be combined in a way that allows an entity to perform unsafe actions that would not be allowed without that combination. Impacted is confidentiality, integrity, and availability. CVE summarizes:

A vulnerability in multiple Cisco Unified Communications and Contact Center Solutions products could allow an authenticated, local attacker to elevate privileges to root on an affected device. This vulnerability is due to excessive permissions that have been assigned to system commands. An attacker could exploit this vulnerability by executing crafted commands on the underlying operating system. A successful exploit could allow the attacker to escape the restricted shell and gain root privileges on the underlying operating system of an affected device. To successfully exploit this vulnerability, an attacker would need administrative access to the ESXi hypervisor.

The advisory is shared for download at sec.cloudapps.cisco.com. This vulnerability is handled as CVE-2025-20112 since 10/10/2024. The exploitation is known to be easy. The attack needs to be approached locally. Additional levels of successful authentication are needed for exploitation. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1068.

The vulnerability scanner Nessus provides a plugin with the ID 237302 (Cisco Unified Communications Manager (CUCM) Privilege Escalation (cisco-sa-cucm-kkhZbHR5)), which helps to determine the existence of the flaw in a target environment.

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (237302) and EUVD (EUVD-2025-16023). Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Unified Communication Software

Vendor

• Cisco

Name

• Emergency Responder
• Finesse
• Prime Collaboration Deployment
• SocialMiner
• Unified Communications Manager
• Unified Communications Manager IM and Presence Service
• Unified Contact Center Express
• Unified Intelligence Center
• Unity Connection
• Virtualized Voice Browser

License

• commercial

Website

• Vendor: https://www.cisco.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion