Vulnerability · Published May 21, 2025 · Assigned by cisco
CVE-2025-20114Cisco Unified Intelligence Center Insecure Direct Object Reference Vulnerability
Medium 4.3
In plain English
A medium-severity authorization bypass via user-controlled key in Cisco Unified Contact Center Express from Cisco. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 29% of all known vulnerabilities).
Official description
A vulnerability in the API of Cisco Unified Intelligence Center could allow an authenticated, remote attacker to perform a horizontal privilege escalation attack on an affected system. This vulnerability is due to insufficient validation of user-supplied parameters in API requests. An attacker could exploit this vulnerability by submitting crafted API requests to an affected system to execute an insecure direct object reference attack. A successful exploit could allow the attacker to access specific data that is associated with different users on the affected system.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Cisco | Cisco Unified Contact Center Express | 10.6(1)10.5(1)SU110.6(1)SU312.0(1)10.0(1)SU110.6(1)SU111.0(1)SU111.5(1)SU1 |
| Cisco | Cisco Unified Intelligence Center | 11.6(1)10.5(1)11.0(1)11.5(1)12.0(1)12.5(1)11.0(2)12.6(1) |
Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N