---
id: CVE-2025-20317
title: Cisco UCS Virtual Keyboard Video Monitor (vKVM) Open Redirect Vulnerability
summary: "A vulnerability in the Virtual Keyboard Video Monitor (vKVM) connection handling of Cisco Integrated Management Controller (IMC) could allow an unauthenticated, remote attacker to redirect a user to a malicious website.\r\n\r\nThis vulnerabili…"
severity: high
cvss: 7.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N'
cvssSource: vendor
vendor: Cisco
product: Cisco Unified Computing System (Managed)
affected:
  - unified_computing_system_managed
  - unified_computing_system_standalone
  - unified_computing_system_e_series_software_ucse
published: '2025-08-27'
updated: '2025-08-27'
sourceUpdated: '2025-08-27T16:00:00+00:00'
source: CSAF
sourceUrl: >-
  https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ucs-vkvmorv-CnKrV7HK
references:
  - url: >-
      https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ucs-vkvmorv-CnKrV7HK
  - url: 'https://software.cisco.com'
tags:
  - csaf
  - vendor-advisory
  - cisco
epss: 0.00429
epssPercentile: 0.34527
ingestedAt: '2026-09-15T16:36:15.247Z'
---

## Overview

A vulnerability in the Virtual Keyboard Video Monitor (vKVM) connection handling of Cisco Integrated Management Controller (IMC) could allow an unauthenticated, remote attacker to redirect a user to a malicious website.

This vulnerability is due to insufficient verification of vKVM endpoints. An attacker could exploit this vulnerability by persuading a user to click a crafted link. A successful exploit could allow the attacker to redirect a user to a malicious webpage and potentially capture user credentials.

Note: The affected vKVM client is also included in Cisco UCS Manager.

Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

## Vendor advisories

- **cisco-sa-ucs-vkvmorv-CnKrV7HK** · Cisco · affected: Cisco Unified Computing System (Managed), Cisco Unified Computing System (Standalone), Cisco Unified Computing System E-Series Software (UCSE) · updated 2025-08-27 · [advisory](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ucs-vkvmorv-CnKrV7HK)

**Cisco Integrated Management Controller Virtual Keyboard Video Monitor Open Redirect Vulnerability**. Released 2025-08-27.

Affected:

- Cisco Unified Computing System (Managed)
- Cisco Unified Computing System (Standalone)
- Cisco Unified Computing System E-Series Software (UCSE)

## Remediation

Cisco has released software updates that address this vulnerability. https://software.cisco.com