{"id":"CVE-2025-20114","title":"Cisco Unified Intelligence Center Insecure Direct Object Reference Vulnerability","summary":"A vulnerability in the API of Cisco Unified Intelligence Center could allow an authenticated, remote attacker to perform a horizontal privilege escalation attack on an affected system.\r\n\r\nThis vulnerability is due to insufficient validat…","severity":"medium","cvss":4.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","cvssSource":"cna","cwe":["CWE-639"],"vendor":"Cisco","product":"Cisco Unified Contact Center Express","affected":["unified_contact_center_express 10.6(1)","unified_contact_center_express 10.5(1)SU1","unified_contact_center_express 10.6(1)SU3","unified_contact_center_express 12.0(1)","unified_contact_center_express 10.0(1)SU1","unified_contact_center_express 10.6(1)SU1","unified_contact_center_express 11.0(1)SU1","unified_contact_center_express 11.5(1)SU1","unified_contact_center_express 10.5(1)","unified_contact_center_express 11.6(1)","unified_contact_center_express 11.6(2)","unified_contact_center_express 12.5(1)","unified_contact_center_express 12.5(1)SU1","unified_contact_center_express 12.5(1)SU2","unified_contact_center_express 12.5(1)SU3","unified_contact_center_express 12.5(1)_SU03_ES01","unified_contact_center_express 12.5(1)_SU03_ES02","unified_contact_center_express 12.5(1)_SU02_ES03","unified_contact_center_express 12.5(1)_SU02_ES04","unified_contact_center_express 12.5(1)_SU02_ES02","unified_contact_center_express 12.5(1)_SU01_ES02","unified_contact_center_express 12.5(1)_SU01_ES03","unified_contact_center_express 12.5(1)_SU02_ES01","unified_contact_center_express 11.6(2)ES07","unified_contact_center_express 11.6(2)ES08","unified_contact_center_express 12.5(1)_SU01_ES01","unified_contact_center_express 12.0(1)ES04","unified_contact_center_express 12.5(1)ES02","unified_contact_center_express 12.5(1)ES03","unified_contact_center_express 11.6(2)ES06","unified_contact_center_express 12.5(1)ES01","unified_contact_center_express 12.0(1)ES03","unified_contact_center_express 12.0(1)ES01","unified_contact_center_express 11.6(2)ES05","unified_contact_center_express 12.0(1)ES02","unified_contact_center_express 11.6(2)ES04","unified_contact_center_express 11.6(2)ES03","unified_contact_center_express 11.6(2)ES02","unified_contact_center_express 11.6(2)ES01","unified_contact_center_express 10.6(1)SU3ES03","unified_contact_center_express 11.0(1)SU1ES03","unified_contact_center_express 10.6(1)SU3ES01","unified_contact_center_express 10.5(1)SU1ES10","unified_contact_center_express 10.0(1)SU1ES04","unified_contact_center_express 11.5(1)SU1ES03","unified_contact_center_express 11.6(1)ES02","unified_contact_center_express 11.5(1)ES01","unified_contact_center_express 9.0(2)SU3ES04","unified_contact_center_express 10.6(1)SU2","unified_contact_center_express 10.6(1)SU2ES04"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2025-05-22T03:55:20.310719Z"},"published":"2025-05-21","updated":"2026-11-03","sourceUpdated":"2026-11-03T22:02:52.086Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-20114","references":[{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cuis-priv-esc-3Pk96SU4","label":"cisco-sa-cuis-priv-esc-3Pk96SU4"}],"tags":["cve.org"],"epss":0.0035,"epssPercentile":0.2878,"ingestedAt":"2026-11-05T20:33:06.532Z","slug":"CVE-2025-20114","body":"## Overview\n\nA vulnerability in the API of Cisco Unified Intelligence Center could allow an authenticated, remote attacker to perform a horizontal privilege escalation attack on an affected system.\r\n\r\nThis vulnerability is due to insufficient validation of user-supplied parameters in API requests. An attacker could exploit this vulnerability by submitting crafted API requests to an affected system to execute an insecure direct object reference attack. A successful exploit could allow the attacker to access specific data that is associated with different users on the affected system.\n\n## Affected\n\n- `unified_contact_center_express 10.6(1)`\n- `unified_contact_center_express 10.5(1)SU1`\n- `unified_contact_center_express 10.6(1)SU3`\n- `unified_contact_center_express 12.0(1)`\n- `unified_contact_center_express 10.0(1)SU1`\n- `unified_contact_center_express 10.6(1)SU1`\n- `unified_contact_center_express 11.0(1)SU1`\n- `unified_contact_center_express 11.5(1)SU1`\n- `unified_contact_center_express 10.5(1)`\n- `unified_contact_center_express 11.6(1)`\n- `unified_contact_center_express 11.6(2)`\n- `unified_contact_center_express 12.5(1)`\n- `unified_contact_center_express 12.5(1)SU1`\n- `unified_contact_center_express 12.5(1)SU2`\n- `unified_contact_center_express 12.5(1)SU3`\n- `unified_contact_center_express 12.5(1)_SU03_ES01`\n- `unified_contact_center_express 12.5(1)_SU03_ES02`\n- `unified_contact_center_express 12.5(1)_SU02_ES03`\n- `unified_contact_center_express 12.5(1)_SU02_ES04`\n- `unified_contact_center_express 12.5(1)_SU02_ES02`\n- `unified_contact_center_express 12.5(1)_SU01_ES02`\n- `unified_contact_center_express 12.5(1)_SU01_ES03`\n- `unified_contact_center_express 12.5(1)_SU02_ES01`\n- `unified_contact_center_express 11.6(2)ES07`\n- `unified_contact_center_express 11.6(2)ES08`\n- `unified_contact_center_express 12.5(1)_SU01_ES01`\n- `unified_contact_center_express 12.0(1)ES04`\n- `unified_contact_center_express 12.5(1)ES02`\n- `unified_contact_center_express 12.5(1)ES03`\n- `unified_contact_center_express 11.6(2)ES06`\n- `unified_contact_center_express 12.5(1)ES01`\n- `unified_contact_center_express 12.0(1)ES03`\n- `unified_contact_center_express 12.0(1)ES01`\n- `unified_contact_center_express 11.6(2)ES05`\n- `unified_contact_center_express 12.0(1)ES02`\n- `unified_contact_center_express 11.6(2)ES04`\n- `unified_contact_center_express 11.6(2)ES03`\n- `unified_contact_center_express 11.6(2)ES02`\n- `unified_contact_center_express 11.6(2)ES01`\n- `unified_contact_center_express 10.6(1)SU3ES03`\n- `unified_contact_center_express 11.0(1)SU1ES03`\n- `unified_contact_center_express 10.6(1)SU3ES01`\n- `unified_contact_center_express 10.5(1)SU1ES10`\n- `unified_contact_center_express 10.0(1)SU1ES04`\n- `unified_contact_center_express 11.5(1)SU1ES03`\n- `unified_contact_center_express 11.6(1)ES02`\n- `unified_contact_center_express 11.5(1)ES01`\n- `unified_contact_center_express 9.0(2)SU3ES04`\n- `unified_contact_center_express 10.6(1)SU2`\n- `unified_contact_center_express 10.6(1)SU2ES04`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":24,"depthScoreParts":{"impact":23.7,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}