What’s Vulnerable › Vulnerabilities
CVE-2025-20114: Cisco Unified Intelligence Center Insecure Direct Object Reference Vulnerability
- Severity: medium (CVSS 4.3 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.4% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2025-05-21 · updated 2026-06-17
- Weakness: CWE-639
Description
A vulnerability in the API of Cisco Unified Intelligence Center could allow an authenticated, remote attacker to perform a horizontal privilege escalation attack on an affected system. This vulnerability is due to insufficient validation of user-supplied parameters in API requests. An attacker could exploit this vulnerability by submitting crafted API requests to an affected system to execute an insecure direct object reference attack. A successful exploit could allow the attacker to access specific data that is associated with different users on the affected system.
Affected products
- Cisco Unified Contact Center Express: 8.5(1), 9.0(2)su3es04, 10.0(1)su1, 10.0(1)su1es04, 10.5(1), 10.5(1)su1 (+54)
- Cisco Unified Intelligence Center: 10.5(1), 11.0(1), 11.0(2), 11.0(3), 11.5(1), 11.6(1) (+7)
References
Get alerted when CVE-2025-20114 or the next vulnerability affects your stack