CVE-2025-20242 is a medium severity (6.5) access control flaw in the Cloud Connect component of Cisco Unified Contact Center Enterprise. An unauthenticated remote attacker could read and modify data. Cisco has released fixed software and offers no workaround, so migrate to a fixed release.
What's affected
Cisco's advisory, published 21 May 2025, says the flaw affects Cisco Unified CCE Cloud Connect regardless of device configuration. The cause is a lack of proper authentication controls. The attacker would send crafted TCP data to a specific port. The weakness is CWE-284, improper access control. The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N.
The advisory's fixed release table reads as follows. Release 12.6.1 and earlier is not vulnerable. Release 12.6.2 is affected and the instruction is to migrate to a fixed release. Release 15.0.1 is not vulnerable. The advisory tells readers to check the bug ID details for the most complete and current information.
Cisco says its Product Security Incident Response Team is not aware of public announcements or malicious use of the vulnerability. It was found while resolving a Cisco TAC support case. The record is not on the CISA Known Exploited Vulnerabilities list.
Fixed versions: the advisory does not name a specific fixed 12.6 build in its table. It says to migrate to a fixed release. Confirm the release with Cisco TAC or the bug ID entry.
How to check if you're exposed
Find your Unified CCE deployment and the Cloud Connect release. Cloud Connect is the component that links the contact center to cloud services, so ask the team that owns your contact center platform where it is installed.
- Record the release number of each Cloud Connect server.
- Compare it to the table above. Release 12.6.2 needs action. Releases 12.6.1 and earlier and 15.0.1 are listed as not vulnerable.
- Check which network ranges can reach the Cloud Connect servers. The advisory describes data sent to a specific port, so network reachability decides your practical exposure.
Cisco says the vulnerability affects the component regardless of configuration, so there is no setting you can inspect to rule it out.
What to do now
- Inventory every Cisco Unified CCE Cloud Connect server and its release.
- For release 12.6.2, plan the migration to a fixed release. Ask Cisco TAC or check the bug ID for the target.
- Because there is no workaround, tighten network access in the meantime. Allow only the hosts that must talk to Cloud Connect, using firewalls or segmentation.
- Review access logs and firewall logs for connections to the service from hosts that should not use it.
- Record the change in your contact center change calendar, since contact center upgrades need a maintenance window.
- Subscribe to Cisco security notifications for the product line.
The network steps in item 3 are general hardening and not part of the advisory.
Why it matters
The record describes missing authentication on a network service. A service that accepts data on a TCP port without asking who is sending it treats every reachable host as trusted. That is how an unauthenticated party ends up able to read and change data.
Contact center platforms hold call data, customer records and routing rules. Even a medium score deserves attention when a service connects an internal system to a cloud service. A narrow fixed release table, as here, means the first job is simply knowing which release you run.
Quick check
Is there a workaround?
Cisco says there are no workarounds. Upgrading is the fix, and restricting network access to the service reduces the exposure until you can.
Which releases are affected?
According to the advisory table, release 12.6.2 needs a migration to a fixed release. Releases 12.6.1 and earlier and 15.0.1 are listed as not vulnerable. Check the bug ID for current details.
Sources
Last reviewed: 19 October 2026.
