PT-2025-22378 · Cisco · Cisco Unified Intelligence Center

Published 2025-05-21 · Updated 2025-07-22 · CVE-2025-20114

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cisco Unified Intelligence Center (affected versions not specified)

Description The issue is due to insufficient validation of user-supplied parameters in API requests, allowing an authenticated, remote attacker to perform a horizontal privilege escalation attack. An attacker could exploit this by submitting crafted API requests to execute an insecure direct object reference attack, potentially accessing specific data associated with different users on the affected system.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

LPE

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

BDU:2025-06734

CVE-2025-20114

Affected Products

Cisco Unified Intelligence Center

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-20114 · Security Note
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cuis-priv-esc-3Pk96SU4 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-06734 · Security Note
• https://osv.dev/vulnerability/CVE-2025-20114 · Vendor Advisory
• https://t.me/cvenotify/129830 · Telegram Post
• https://twitter.com/CVEnew/status/1925232474663051774 · Twitter Post
• https://twitter.com/UndercodeNews/status/1925531893157478618 · Twitter Post
• https://t.me/cveNotify/129830 · Telegram Post