Description
A vulnerability in the file opening process of Cisco Unified Contact Center Express (Unified CCX) Editor could allow an unauthenticated attacker to execute arbitrary code on an affected device. This vulnerability is due to insecure deserialization of Java objects by the affected software. An attacker could exploit this vulnerability by persuading an authenticated, local user to open a crafted .aef file. A successful exploit could allow the attacker to execute arbitrary code on the host that is running the editor application with the privileges of the user who launched it.
References (1)
Core 1
Core References
Scores
CVSS v3
5.3
EPSS
0.0062
EPSS Percentile
70.4%
Attack Vector
LOCAL
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
total
Details
CWE
CWE-502
Status
published
Products (50)
cisco/unified_contact_center_express
8.5\(1\)
cisco/unified_contact_center_express
9.0\(2\)su3es04
cisco/unified_contact_center_express
10.0\(1\)su1
cisco/unified_contact_center_express
10.0\(1\)su1es04
cisco/unified_contact_center_express
10.5\(1\)
cisco/unified_contact_center_express
10.5\(1\)su1
cisco/unified_contact_center_express
10.5\(1\)su1es10
cisco/unified_contact_center_express
10.6\(1\)
cisco/unified_contact_center_express
10.6\(1\)su1
cisco/unified_contact_center_express
10.6\(1\)su2
... and 40 more
Published
Jun 04, 2025
Tracked Since
Feb 18, 2026