Cisco Patches Two Vulnerabilities in CCP and ISE: Proof-of-Concept Exploits Publicly Available

Cisco has issued advisories for two newly disclosed vulnerabilities affecting widely used enterprise software: Cisco Customer Collaboration Platform (CCP) and Cisco Identity Services Engine (ISE). These flaws, tracked as CVE-2025-20129 and CVE-2025-20130, carry CVSS scores of 4.3 and 4.9 respectively, and while not rated as high severity, they pose significant risks due to the availability of proof-of-concept (PoC) exploit code.

The first vulnerability (CVE-2025-20129) lies within the web-based chat interface of Cisco CCP, formerly known as Cisco SocialMiner. According to Cisco’s advisory:

“A vulnerability in the web-based chat interface of Cisco Customer Collaboration Platform… could allow an unauthenticated, remote attacker to persuade users to disclose sensitive data.”

The issue arises from improper sanitization of HTTP requests. An attacker can exploit this by sending crafted HTTP requests to the web-based chat, redirecting traffic to a malicious server they control. If successful, attackers could intercept sensitive information shared during the chat sessions.

The affected versions include:

• Earlier than 12.5(1) → Must migrate
• 12.5(1) SU2 or SU4 → Must migrate
• 15.0 and later → Not vulnerable

Fixes are available in Unified Contact Center Express 15.0(1).

The second flaw (CVE-2025-20130) impacts Cisco’s Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC). It allows an authenticated attacker with admin privileges to upload arbitrary files.

Cisco explains: “This vulnerability is due to improper validation of the file copy function… A successful exploit could allow the attacker to upload arbitrary files to an affected system.”

Again, while no in-the-wild attacks have been observed, the public availability of PoC exploit code raises the urgency for immediate patching.

The affected versions include:

• ISE 3.0 and earlier → Must migrate
• ISE 3.1 → Fixed in 3.1 P10
• ISE 3.2 → Fixed in 3.2 P7
• ISE 3.3 → Fixed in 3.3 P3
• ISE 3.4 → Not vulnerable

Related Posts:

• Critical Cisco ISE Cloud Vulnerability (CVSS 9.9) with PoC Exploit Threatens AWS, Azure, OCI
• RADIUS Risk: Unauthenticated Remote Attacker Can Crash Cisco ISE by Default
• Warning: CVE-2024-20469 in Cisco ISE with PoC Code Puts Networks at Risk
• Cisco Addresses Multiple Security Vulnerabilities Affecting its Products
• CVE-2025-20124 (CVSS 9.9) & CVE-2025-20125 (CVSS 9.1): Cisco Patches Critical Flaws in Identity Services Engine