A vulnerability in the Virtual Keyboard Video Monitor (vKVM) connection handling of Cisco Integrated Management Controller (IMC) could allow an unauthenticated, remote attacker to redirect a user to a malicious website.
This vulnerability is due to insufficient verification of vKVM endpoints. An attacker could exploit this vulnerability by persuading a user to click a crafted link. A successful exploit could allow the attacker to redirect a user to a malicious webpage and potentially capture user credentials.
Note: The affected vKVM client is also included in Cisco UCS Manager.
Metrics
Affected Vendors & Products
References
History
Wed, 27 Aug 2025 22:00:00 +0000
Type | Values Removed | Values Added |
---|---|---|
First Time appeared |
Cisco
Cisco integrated Management Controller Cisco ucs Manager Cisco virtual Keyboard Video Monitor |
|
Vendors & Products |
Cisco
Cisco integrated Management Controller Cisco ucs Manager Cisco virtual Keyboard Video Monitor |
Wed, 27 Aug 2025 19:15:00 +0000
Type | Values Removed | Values Added |
---|---|---|
Metrics |
ssvc
|
Wed, 27 Aug 2025 16:45:00 +0000
Type | Values Removed | Values Added |
---|---|---|
Description | A vulnerability in the Virtual Keyboard Video Monitor (vKVM) connection handling of Cisco Integrated Management Controller (IMC) could allow an unauthenticated, remote attacker to redirect a user to a malicious website. This vulnerability is due to insufficient verification of vKVM endpoints. An attacker could exploit this vulnerability by persuading a user to click a crafted link. A successful exploit could allow the attacker to redirect a user to a malicious webpage and potentially capture user credentials. Note: The affected vKVM client is also included in Cisco UCS Manager. | |
Title | Cisco UCS Virtual Keyboard Video Monitor (vKVM) Open Redirect Vulnerability | |
Weaknesses | CWE-601 | |
References |
| |
Metrics |
cvssV3_1
|

Status: PUBLISHED
Assigner: cisco
Published: 2025-08-27T16:23:18.607Z
Updated: 2025-08-27T18:52:07.395Z
Reserved: 2024-10-10T19:15:13.253Z
Link: CVE-2025-20317

Updated: 2025-08-27T17:24:39.117Z

Status : Awaiting Analysis
Published: 2025-08-27T17:15:36.140
Modified: 2025-08-29T16:24:09.860
Link: CVE-2025-20317

No data.