5.4

CVE-2025-20342: cisco cisco unified computing system e-series software (ucse)

CVSS: 5.4v3.1MediumDeferred
Published 27-08-2025Last modified 27-08-2025
Open JSON

Vulnerability summary

CVE-2025-20342 is a medium (CVSS 5.4) vulnerability in cisco cisco unified computing system e-series software (ucse). EPSS estimates a 0.22% chance of exploitation in the next 30 days, higher than 12.2% of scored vulnerabilities.

Overall risk
22/100
0100
Low · default modelHow is this calculated?
CVSS score
5.4/10
010
Medium · v3.1 (CVE.org)
EPSS score
0.22%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Timeline

  1. 27-08-2025
    PublishedVulnerability first disclosed.
  2. 27-08-2025
    Last modifiedVulnerability information updated.

Description

A vulnerability in the Virtual Keyboard Video Monitor (vKVM) connection handling of Cisco Integrated Management Controller (IMC) could allow an authenticated, remote attacker with low privileges to conduct a stored cross-site scripting (XSS) attack against a user of the interface. This vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected system. An attacker could exploit this vulnerability by injecting malicious code into a specific data field in the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. To exploit this vulnerability, the attacker must have valid user credentials with privileges that allow for vKVM access on the affected device. Note: The affected vKVM client is also included in Cisco UCS Manager.

CVSS metrics

2 scores · 2 sources · 1 version

EPSS trend

Probability

0.22%

Chance of exploitation in the next 30 days

Percentile

12%

Versus all other CVEs

30-day change

0.00 pp

From 0.22% on 18-09-2026

18-09-202618-10-2026
EPSS score
0.22%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Cisco3 products
  • cisco unified computing system e-series software (ucse)3.2.7 | 3.2.6 | 3.2.4 | 3.2.10 | 3.2.2 | 3.2.3 | 2.4.0 | 3.2.1 | 3.2.11.1 | 3.2.8 | 3.1.1 | 3.0.2 | 2.1.0 | 2.2.2 | 3.1.2 | 3.0.1 | 2.3.2 | 2.3.5 | 2.2.1 | 3.1.4 | 2.4.1 | 2.3.1 | 3.1.3 | 2.3.3 | 2.4.2 | 3.1.5 | 3.1.0 | 2.0.0 | 3.2.11.3 | 3.2.11.5 | 3.2.12.2 | 3.2.13.6 | 3.2.14 | 4.11.1 | 3.2.15 | 4.12.1 | 3.2.15.3 | 4.12.2 | 3.2.16.1 | 2.02 | 4.00
  • cisco unified computing system (managed)4.0(1a) | 3.2(3n) | 4.1(1a) | 4.1(1b) | 4.0(4h) | 4.1(1c) | 3.2(3k) | 3.2(2c) | 4.0(4e) | 4.0(4g) | 3.2(3i) | 4.0(2e) | 3.2(3g) | 4.0(4a) | 4.0(2d) | 3.2(2d) | 4.0(1b) | 4.0(4f) | 3.2(3h) | 3.2(2f) | 4.0(4c) | 3.2(3a) | 4.0(1c) | 3.2(3d) | 3.2(2b) | 4.0(4b) | 3.2(2e) | 4.0(2b) | 4.0(4d) | 3.2(1d) | 3.2(3e) | 3.2(3l) | 3.2(3b) | 4.0(2a) | 3.2(3j) | 4.0(1d) | 3.2(3o) | 4.0(4i) | 4.1(1d) | 4.1(2a) | 4.1(1e) | 3.2(3p) | 4.1(2b) | 4.0(4k) | 4.1(3a) | 4.1(3b) | 4.1(2c) | 4.0(4l) | 4.1(4a) | 4.1(3c) | 4.1(3d) | 4.2(1c) | 4.2(1d) | 4.0(4m) | 4.1(3e) | 4.2(1f) | 4.1(3f) | 4.2(1i) | 4.1(3h) | 4.2(1k) | 4.2(1l) | 4.0(4n) | 4.2(1m) | 4.1(3i) | 4.2(2a) | 4.2(1n) | 4.1(3j) | 4.2(2c) | 4.2(2d) | 4.2(3b) | 4.1(3k) | 4.0(4o) | 4.2(2e) | 4.2(3d) | 4.2(3e) | 4.2(3g) | 4.1(3l) | 4.3(2b) | 4.2(3h) | 4.2(3i) | 4.3(2c) | 4.1(3m) | 4.3(2e) | 4.3(3a) | 4.2(3j) | 4.3(3c) | 4.3(4a) | 4.2(3k) | 4.3(4b) | 4.3(4c) | 4.2(3l) | 4.3(4d) | 4.3(2f) | 4.2(3m) | 4.3(5a) | 4.3(4e) | 4.1(3n) | 4.3(4f) | 4.2(3n) | 4.3(5c) | 4.2(3o) | 4.3(5d) | 4.3(5e)
  • cisco unified computing system (standalone)2.0(1a) | 4.0(2g) | 2.0(13f) | 3.0(4n) | 2.0(3e)1 | 3.0(3e) | 2.0(8h) | 2.0(10g) | 3.1(2i) | 3.0(3c) | 3.0(4m) | 3.1(1d) | 3.0(3a) | 3.0(1d) | 2.0(9o) | 2.0(13n) | 4.0(4i) | 4.1(1c) | 2.0(13q) | 2.0(3j)1 | 4.0(2c) | 2.0(9n) | 4.0(1e) | 2.0(13o) | 2.0(6f) | 2.0(10c) | 2.0(8d) | 2.0(9m) | 4.0(2h) | 3.0(4j) | 2.0(10i) | 3.0(3f) | 2.0(10l) | 2.0(12e) | 2.0(12i) | 2.0(10h) | 2.0(13e) | 3.0(4k) | 2.0(10b) | 2.0(6d) | 2.0(12b) | 4.0(4h) | 2.0(12h) | 2.0(10f) | 3.0(4l) | 4.0(1h) | 4.0(2l) | 2.0(3i) | 2.0(3f)3 | 3.0(4a) | 2.0(13p) | 2.0(9l) | 2.0(12g) | 2.0(12c) | 2.0(12f) | 2.0(13k) | 3.0(3b) | 2.0(1b) | 3.1(3g) | 2.0(4c) | 4.0(1.240) | 2.0(12d) | 4.0(2f) | 4.0(1g) | 3.0(4d) | 3.0(2b) | 2.0(3d)2 | 2.0(3d)1 | 2.0(9f) | 2.0(13h) | 3.0(4e) | 2.0(8g) | 4.0(2i) | 2.0(10e) | 2.0(13i) | 2.0(9c) | 2.0(4c)1 | 3.0(1c) | 2.0(8e) | 2.0(9e) | 2.0(9p) | 3.1(3i) | 3.0(4i) | 2.0(10k) | 3.0(4o) | 4.0(4d) | 4.1(1d) | 3.1(3c) | 4.0(4k) | 3.1(2d) | 3.1(3a) | 3.1(3j) | 4.0(2d) | 4.1(1f) | 3.0(4p) | 4.0(1c) | 4.0(4f) | 4.0(4c) | 3.1(3d) | 3.1(2g) | 3.1(2c) | 4.0(1d) | 3.1(2e) | 4.0(1a) | 4.0(1b) | 3.1(3b) | 4.0(4b) | 3.1(2b) | 4.0(4e) | 3.1(3h) | 3.0(4q) | 4.0(4l) | 4.1(1g) | 4.1(2a) | 3.0(4r) | 4.0(2n) | 4.1(1h) | 3.1(3k) | 4.1(2b) | 4.0(2o) | 4.0(4m) | 4.1(2d) | 4.1(3b) | 4.0(2p) | 4.1(2e) | 4.1(2f) | 3.0(4s) | 4.0(4n) | 4.0(2q) | 4.1(3c) | 4.0(2r) | 4.1(3d) | 4.1(2g) | 4.1(2h) | 4.1(3f) | 4.1(2j) | 4.1(2k) | 4.1(3h) | 4.2(2a) | 4.1(3i) | 4.2(2f) | 4.2(2g) | 4.2(3b) | 4.1(3l) | 4.2(3d) | 4.3(1.230097) | 4.2(1e) | 4.2(1b) | 4.2(1j) | 4.2(1i) | 4.2(1f) | 4.2(1a) | 4.2(1c) | 4.2(1g) | 4.3(1.230124) | 4.1(2l) | 4.2(3e) | 4.3(1.230138) | 4.2(3g) | 4.3(2.230207) | 4.2(3h) | 4.2(3i) | 4.3(2.230270) | 4.1(3m) | 4.1(2m) | 4.3(2.240002) | 4.3(3.240022) | 4.2(3j) | 4.1(3n) | 4.3(2.240009) | 4.3(3.240043) | 4.3(4.240142) | 4.3(2.240037) | 4.3(2.240053) | 4.3(4.240152) | 4.2(3l) | 4.3(2.240077) | 4.3(4.242028) | 4.3(4.241063) | 4.3(4.242038) | 4.2(3m) | 4.3(2.240090) | 4.3(5.240021) | 4.3(2.240107) | 4.3(4.242066) | 4.2(3n) | 4.3(2.250016) | 4.3(2.250021) | 4.3(2.250022) | 4.3(2.250037) | 4.3(2.250045) | 4.3(4.252001)

1 vendor · 3 products

References

1 links