CVE-2025-20112
CVE-2025-20112 is a medium-severity vulnerability with a CVSS 3.x base score of 5.1. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-268.
Key facts
- Severity: Medium (CVSS 3.x base score 5.1)
- EPSS exploit prediction: 0% (2nd percentile)
- Actively exploited: Not listed in CISA KEV
- EU (EUVD) id: EUVD-2025-16023
- Weakness: CWE-268
- Published:
- Last modified:
Description
A vulnerability in multiple Cisco Unified Communications and Contact Center Solutions products could allow an authenticated, local attacker to elevate privileges to root on an affected device. This vulnerability is due to excessive permissions that have been assigned to system commands. An attacker could exploit this vulnerability by executing crafted commands on the underlying operating system. A successful exploit could allow the attacker to escape the restricted shell and gain root privileges on the underlying operating system of an affected device. To successfully exploit this vulnerability, an attacker would need administrative access to the ESXi hypervisor.
Frequently asked questions
- What is CVE-2025-20112?
- A vulnerability in multiple Cisco Unified Communications and Contact Center Solutions products could allow an authenticated, local attacker to elevate privileges to root on an affected device. This vulnerability is due to excessive permissions that have been assigned to system commands. An attacker could exploit this vulnerability by executing crafted commands on the underlying operating system. A successful exploit could allow the attacker to escape the restricted shell and gain root privileges on the underlying operating system of an affected device. To successfully exploit this vulnerability, an attacker would need administrative access to the ESXi hypervisor.
- How severe is CVE-2025-20112?
- CVE-2025-20112 has a CVSS 3.x base score of 5.1, rated medium severity. It is exploitable over local access with low attack complexity, requires high privileges and no user interaction. Impact on confidentiality is low, integrity high, and availability none.
- Is CVE-2025-20112 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (2nd percentile), an estimate of the probability of exploitation in the next 30 days.
- How do I fix CVE-2025-20112?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- Does CVE-2025-20112 have an EU (EUVD) identifier?
- Yes. CVE-2025-20112 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-16023.
- When was CVE-2025-20112 published?
- CVE-2025-20112 was published on 2025-05-21 and last updated on 2026-06-17.
References
- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-kkhZbHR5
Other CWE-268 vulnerabilities
- CVE-2024-4877 — High (CVSS 8.8): OpenVPN version 2.4.0 through 2.6.10 on Windows allows an external, lesser privileged process to create a named pipe…
- CVE-2023-0759 — High (CVSS 8.8): Privilege Chaining in GitHub repository cockpit-hq/cockpit prior to 2.3.8.
- CVE-2025-7973 — High (CVSS 8.5): A security issue exists in FactoryTalk ViewPoint version 14.0 or below due to improper handling of MSI repair…
- CVE-2026-32325 — High (CVSS 7.8): Privilege chaining issue exists in ServerView Agents for Windows V11.60.04 and earlier. If this vulnerability is…
- CVE-2026-3888 — High (CVSS 7.8): Local privilege escalation in snapd on Linux allows local attackers to get root privilege by re-creating snap's private…
- CVE-2025-64701 — High (CVSS 7.8): QND Premium/Advance/Standard Ver.11.0.9i and prior contains a privilege escalation vulnerability, which may allow a…