Cisco Unified Intelligence Center Privilege Escalation Vulnerabilities (CVE-2025-20113/20114)

Critical Vulnerability Information Vulnerability Overview CVE IDs: CVE-2025-20113, CVE-2025-20114 CVSS Score: 7.1 (CVE-2025-20113), 4.3 (CVE-2025-20114) Severity: High Affected Products Cisco Unified Intelligence Center Includes Unified Intelligence Center used as part of the following Cisco solutions: - Packaged Contact Center Enterprise (Packaged CCE) - Unified Contact Center Enterprise (Unified CCE) - Unified Contact Center Express (Unified CCX) (since Unified CCX includes Unified Intelligence Center as part of its software package) Vulnerability Details 1. CVE-2025-20113: Cisco Unified Intelligence Center Privilege Escalation Vulnerability - Due to insufficient server-side validation of user-supplied parameters in API or HTTP requests, an authenticated remote attacker can escalate privileges to administrator level. - Successful exploitation allows the attacker to access, modify, or delete data beyond their intended access level, including potentially sensitive information stored in the system. 2. CVE-2025-20114: Cisco Unified Intelligence Center Horizontal Privilege Escalation Vulnerability - Due to insufficient validation of user-supplied parameters in API requests, an authenticated remote attacker can perform cross-object reference attacks on the affected system. - Successful exploitation allows the attacker to access sensitive data associated with different users. Solution Cisco has released software updates to address these vulnerabilities. No workarounds are available to mitigate these vulnerabilities. Fixed Software Customers should upgrade to the appropriate fixed software versions as described in this section. Specific versions and fix details are available in the “Fixed Releases” section.

Goal Reached Thanks to every supporter — we hit 100%!

Cisco Unified Intelligence Center Privilege Escalation Vulnerabilities (CVE-2025-20113/20114)