---
id: CVE-2025-20114
title: >-
  Cisco Unified Intelligence Center Insecure Direct Object Reference
  Vulnerability
summary: "A vulnerability in the API of Cisco Unified Intelligence Center could allow an authenticated, remote attacker to perform a horizontal privilege escalation attack on an affected system.\r\n\r\nThis vulnerability is due to insufficient validat…"
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-639
vendor: Cisco
product: Cisco Unified Contact Center Express
affected:
  - unified_contact_center_express 10.6(1)
  - unified_contact_center_express 10.5(1)SU1
  - unified_contact_center_express 10.6(1)SU3
  - unified_contact_center_express 12.0(1)
  - unified_contact_center_express 10.0(1)SU1
  - unified_contact_center_express 10.6(1)SU1
  - unified_contact_center_express 11.0(1)SU1
  - unified_contact_center_express 11.5(1)SU1
  - unified_contact_center_express 10.5(1)
  - unified_contact_center_express 11.6(1)
  - unified_contact_center_express 11.6(2)
  - unified_contact_center_express 12.5(1)
  - unified_contact_center_express 12.5(1)SU1
  - unified_contact_center_express 12.5(1)SU2
  - unified_contact_center_express 12.5(1)SU3
  - unified_contact_center_express 12.5(1)_SU03_ES01
  - unified_contact_center_express 12.5(1)_SU03_ES02
  - unified_contact_center_express 12.5(1)_SU02_ES03
  - unified_contact_center_express 12.5(1)_SU02_ES04
  - unified_contact_center_express 12.5(1)_SU02_ES02
  - unified_contact_center_express 12.5(1)_SU01_ES02
  - unified_contact_center_express 12.5(1)_SU01_ES03
  - unified_contact_center_express 12.5(1)_SU02_ES01
  - unified_contact_center_express 11.6(2)ES07
  - unified_contact_center_express 11.6(2)ES08
  - unified_contact_center_express 12.5(1)_SU01_ES01
  - unified_contact_center_express 12.0(1)ES04
  - unified_contact_center_express 12.5(1)ES02
  - unified_contact_center_express 12.5(1)ES03
  - unified_contact_center_express 11.6(2)ES06
  - unified_contact_center_express 12.5(1)ES01
  - unified_contact_center_express 12.0(1)ES03
  - unified_contact_center_express 12.0(1)ES01
  - unified_contact_center_express 11.6(2)ES05
  - unified_contact_center_express 12.0(1)ES02
  - unified_contact_center_express 11.6(2)ES04
  - unified_contact_center_express 11.6(2)ES03
  - unified_contact_center_express 11.6(2)ES02
  - unified_contact_center_express 11.6(2)ES01
  - unified_contact_center_express 10.6(1)SU3ES03
  - unified_contact_center_express 11.0(1)SU1ES03
  - unified_contact_center_express 10.6(1)SU3ES01
  - unified_contact_center_express 10.5(1)SU1ES10
  - unified_contact_center_express 10.0(1)SU1ES04
  - unified_contact_center_express 11.5(1)SU1ES03
  - unified_contact_center_express 11.6(1)ES02
  - unified_contact_center_express 11.5(1)ES01
  - unified_contact_center_express 9.0(2)SU3ES04
  - unified_contact_center_express 10.6(1)SU2
  - unified_contact_center_express 10.6(1)SU2ES04
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2025-05-22T03:55:20.310719Z'
published: '2025-05-21'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T22:02:52.086Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-20114'
references:
  - url: >-
      https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cuis-priv-esc-3Pk96SU4
    label: cisco-sa-cuis-priv-esc-3Pk96SU4
tags:
  - cve.org
epss: 0.0035
epssPercentile: 0.2878
ingestedAt: '2026-11-05T20:33:06.532Z'
---

## Overview

A vulnerability in the API of Cisco Unified Intelligence Center could allow an authenticated, remote attacker to perform a horizontal privilege escalation attack on an affected system.

This vulnerability is due to insufficient validation of user-supplied parameters in API requests. An attacker could exploit this vulnerability by submitting crafted API requests to an affected system to execute an insecure direct object reference attack. A successful exploit could allow the attacker to access specific data that is associated with different users on the affected system.

## Affected

- `unified_contact_center_express 10.6(1)`
- `unified_contact_center_express 10.5(1)SU1`
- `unified_contact_center_express 10.6(1)SU3`
- `unified_contact_center_express 12.0(1)`
- `unified_contact_center_express 10.0(1)SU1`
- `unified_contact_center_express 10.6(1)SU1`
- `unified_contact_center_express 11.0(1)SU1`
- `unified_contact_center_express 11.5(1)SU1`
- `unified_contact_center_express 10.5(1)`
- `unified_contact_center_express 11.6(1)`
- `unified_contact_center_express 11.6(2)`
- `unified_contact_center_express 12.5(1)`
- `unified_contact_center_express 12.5(1)SU1`
- `unified_contact_center_express 12.5(1)SU2`
- `unified_contact_center_express 12.5(1)SU3`
- `unified_contact_center_express 12.5(1)_SU03_ES01`
- `unified_contact_center_express 12.5(1)_SU03_ES02`
- `unified_contact_center_express 12.5(1)_SU02_ES03`
- `unified_contact_center_express 12.5(1)_SU02_ES04`
- `unified_contact_center_express 12.5(1)_SU02_ES02`
- `unified_contact_center_express 12.5(1)_SU01_ES02`
- `unified_contact_center_express 12.5(1)_SU01_ES03`
- `unified_contact_center_express 12.5(1)_SU02_ES01`
- `unified_contact_center_express 11.6(2)ES07`
- `unified_contact_center_express 11.6(2)ES08`
- `unified_contact_center_express 12.5(1)_SU01_ES01`
- `unified_contact_center_express 12.0(1)ES04`
- `unified_contact_center_express 12.5(1)ES02`
- `unified_contact_center_express 12.5(1)ES03`
- `unified_contact_center_express 11.6(2)ES06`
- `unified_contact_center_express 12.5(1)ES01`
- `unified_contact_center_express 12.0(1)ES03`
- `unified_contact_center_express 12.0(1)ES01`
- `unified_contact_center_express 11.6(2)ES05`
- `unified_contact_center_express 12.0(1)ES02`
- `unified_contact_center_express 11.6(2)ES04`
- `unified_contact_center_express 11.6(2)ES03`
- `unified_contact_center_express 11.6(2)ES02`
- `unified_contact_center_express 11.6(2)ES01`
- `unified_contact_center_express 10.6(1)SU3ES03`
- `unified_contact_center_express 11.0(1)SU1ES03`
- `unified_contact_center_express 10.6(1)SU3ES01`
- `unified_contact_center_express 10.5(1)SU1ES10`
- `unified_contact_center_express 10.0(1)SU1ES04`
- `unified_contact_center_express 11.5(1)SU1ES03`
- `unified_contact_center_express 11.6(1)ES02`
- `unified_contact_center_express 11.5(1)ES01`
- `unified_contact_center_express 9.0(2)SU3ES04`
- `unified_contact_center_express 10.6(1)SU2`
- `unified_contact_center_express 10.6(1)SU2ES04`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.