Affected Vendors
- Cisco: 11 CVEs (2 critical, 1 high, 8 medium)
- ASUS: 1 CVE (unrated)
Overview
This week brings 12 new router and network appliance vulnerabilities, with Cisco dominating the disclosure list. Two critical vulnerabilities in Cisco's Unified Contact Center Express (CCX) platform demand immediate attention, as they allow unauthenticated remote attackers to execute arbitrary code and bypass authentication controls. Organizations running Cisco CCX, ISE, or related unified communications infrastructure should prioritize patching this week.
Critical Vulnerabilities
Cisco Unified CCX Remote Code Execution (CVE-2025-20354, CVSS 9.8) — A flaw in the Java Remote Method Invocation (RMI) process allows unauthenticated attackers to upload arbitrary files and execute commands with system privileges. This is the highest-severity issue this week and affects any exposed CCX deployment.
Cisco Unified CCX Authentication Bypass (CVE-2025-20358, CVSS 9.4) — The CCX Editor application lacks proper authentication controls, enabling remote attackers to gain administrative access without credentials. Combined with CVE-2025-20354, this represents a critical risk chain.
Cisco ISE RADIUS DoS (CVE-2025-20343, CVSS 8.6) — A logic flaw in the ISE RADIUS rejection mechanism could allow attackers to trigger denial-of-service conditions against authentication infrastructure.
Additional Cisco Issues
The remaining eight Cisco CVEs cover authenticated file upload vulnerabilities in CCX's web UI (CVE-2025-20375, CVE-2025-20376), directory traversal via the CCX web interface (CVE-2025-20374), reflected XSS flaws in ISE management consoles (CVE-2025-20303, CVE-2025-20304, CVE-2025-20289), and information disclosure in Unified Intelligence Center's API (CVE-2025-20377). While these are medium severity, they increase risk in defense-in-depth scenarios, especially XSS attacks targeting administrators.
ASUS Driver Issue
ASUS AsIO3.sys Buffer Handling (CVE-2025-9338) — An unrated memory buffer vulnerability in the AsIO driver can be triggered locally. While not critical for remote networks, local privilege escalation is worth tracking if ASUS-based routers or appliances are deployed in your environment.
Recommendations
- Check Cisco security advisories immediately for CCX and ISE patch availability
- Isolate or restrict network access to CCX Editor and RMI services if patching is delayed
- Review ISE deployments for RADIUS configuration and apply fixes promptly
- Update ASUS drivers where deployed in management or gateway roles