Analysis Summary

CVE-2025-20307 CVSS:4.8

Cisco BroadWorks Application Delivery Platform is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote authenticated attacker could exploit this vulnerability to execute script in a victim's Web browser within the security context of the hosting Web site. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.

CVE-2025-20308 CVSS:6

Cisco Spaces Connector could allow a local authenticated attacker to elevate privileges and execute arbitrary commands on the underlying operating system as root, caused by insufficient restrictions during the execution of specific CLI commands. By logging in to the Cisco Spaces Connector CLI as the spacesadmin user and executing a specific command with crafted parameters, an attacker could exploit this vulnerability to elevate privileges from the spacesadmin user and execute arbitrary commands on the underlying operating system as root.

CVE-2025-20309 CVSS:10

Cisco Unified Communications Manager contains a default account, caused by the presence of static user credentials for the root account that are reserved for use during development. A remote attacker could exploit this vulnerability to log in to an affected system and execute arbitrary commands as the root user.

CVE-2025-20310 CVSS:6.1

Cisco Enterprise Chat and Email (ECE) is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by the web UI. A remote attacker could exploit this vulnerability to execute script in a victim's Web browser within the security context of the hosting Web site. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.

Impact

• Cross-Site Scripting
• Privilege Escalation
• Gain Access

Indicators of Compromise

CVE

• CVE-2025-20307

• CVE-2025-20308

• CVE-2025-20309

• CVE-2025-20310

Affected Vendors

Remediation

Refer to Cisco Security Advisory for patch, upgrade, or suggested workaround information.

CVE-2025-20307

CVE-2025-20308

CVE-2025-20309

CVE-2025-20310