Cisco Unified Contact Center Express Privilege Escalation Vulnerability
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-434.
Summary
A vulnerability in the Administration Web Interface of Cisco Unified Contact Center Express (Unified CCX) could allow an authenticated, remote attacker to upload arbitrary files and execute commands on the underlying operating system. To exploit this vulnerability, an attacker needs valid Administrator credentials. The vulnerability is due to insufficient restrictions for the content uploaded to an affected system. An attacker could exploit this vulnerability by uploading arbitrary files containing operating system commands that will be executed by an affected system. A successful exploit could allow the attacker to execute arbitrary commands with the privileges of the web interface and then elevate their privileges to root.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Cisco | Cisco Unified Contact Center Express | all versions | — | No fix listed | CNA |
- Cisco Unified Contact Center Express VendorCisco Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 5
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:cisco:unified_contact_center_express:11.6\(1\):*:*:*:*:*:*:* | 11.6(1) | Vulnerable | Cisco |
| cpe:2.3:a:cisco:unified_contact_center_express:11.6\(2\):*:*:*:*:*:*:* | 11.6(2) | Vulnerable | Cisco |
| cpe:2.3:a:cisco:unified_contact_center_express:12.0\(1\):*:*:*:*:*:*:* | 12.0(1) | Vulnerable | Cisco |
| cpe:2.3:a:cisco:unified_ip_interactive_voice_response:11.6\(1\):*:*:*:*:*:*:* | 11.6(1) | Vulnerable | Cisco |
| cpe:2.3:a:cisco:unified_ip_interactive_voice_response:11.6\(2\):*:*:*:*:*:*:* | 11.6(2) | Vulnerable | Cisco |
- cpe:2.3:a:cisco:unified_contact_center_express:11.6\(1\):*:*:*:*:*:*:* Versions 11.6(1) Vulnerable ·Cisco
- cpe:2.3:a:cisco:unified_contact_center_express:11.6\(2\):*:*:*:*:*:*:* Versions 11.6(2) Vulnerable ·Cisco
- cpe:2.3:a:cisco:unified_contact_center_express:12.0\(1\):*:*:*:*:*:*:* Versions 12.0(1) Vulnerable ·Cisco
- cpe:2.3:a:cisco:unified_ip_interactive_voice_response:11.6\(1\):*:*:*:*:*:*:* Versions 11.6(1) Vulnerable ·Cisco
- cpe:2.3:a:cisco:unified_ip_interactive_voice_response:11.6\(2\):*:*:*:*:*:*:* Versions 11.6(2) Vulnerable ·Cisco
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2019-1888
- 2026-10-03 Alias added: GHSA-93x8-xp39-6r6f
References
More Cisco Unified Contact Center Express vulnerabilities
- TI-2021-19919 Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints KEVCVSS 3.1CRITICAL 10.0
- TI-2020-02838 Cisco Unified Contact Center Express Remote Code Execution Vulnerability CVSS 3.1CRITICAL 9.8
- TI-2018-00362 Cross-site scripting in Cisco Unified Contact Center Express unknown CVSS 3.0CRITICAL 9.8
- TI-2024-13188 Deserialization of untrusted data in Cisco Unified Contact Center Enterprise CVSS 3.1CRITICAL 10.0
- TI-2025-14653 Cisco Unified Contact Center Express Editor Authentication Bypass Vulnerability CVSS 3.1CRITICAL 9.8
- TI-2017-09109 Improper authentication in Cisco Voice Operating System CVSS 3.0CRITICAL 9.8
Sources
- CVE-2019-1888 · CVE Program
- CVE-2019-1888 · NVD
- FIRST EPSS
- GHSA-93x8-xp39-6r6f · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences