CVE-2025-20114

Description

A vulnerability in the API of Cisco Unified Intelligence Center could allow an authenticated, remote attacker to perform a horizontal privilege escalation attack on an affected system. This vulnerability is due to insufficient validation of user-supplied parameters in API requests. An attacker could exploit this vulnerability by submitting crafted API requests to an affected system to execute an insecure direct object reference attack. A successful exploit could allow the attacker to access specific data that is associated with different users on the affected system.

Reserved 2024-10-10 | Published 2025-05-21 | Updated 2025-05-22 | Assigner cisco

Problem types

Authorization Bypass Through User-Controlled Key

Product status

Default status
unknown

10.6(1)
affected

10.5(1)SU1
affected

10.6(1)SU3
affected

12.0(1)
affected

10.0(1)SU1
affected

10.6(1)SU1
affected

11.0(1)SU1
affected

11.5(1)SU1
affected

10.5(1)
affected

11.6(1)
affected

11.6(2)
affected

12.5(1)
affected

12.5(1)SU1
affected

12.5(1)SU2
affected

12.5(1)SU3
affected

12.5(1)_SU03_ES01
affected

12.5(1)_SU03_ES02
affected

12.5(1)_SU02_ES03
affected

12.5(1)_SU02_ES04
affected

12.5(1)_SU02_ES02
affected

12.5(1)_SU01_ES02
affected

12.5(1)_SU01_ES03
affected

12.5(1)_SU02_ES01
affected

11.6(2)ES07
affected

11.6(2)ES08
affected

12.5(1)_SU01_ES01
affected

12.0(1)ES04
affected

12.5(1)ES02
affected

12.5(1)ES03
affected

11.6(2)ES06
affected

12.5(1)ES01
affected

12.0(1)ES03
affected

12.0(1)ES01
affected

11.6(2)ES05
affected

12.0(1)ES02
affected

11.6(2)ES04
affected

11.6(2)ES03
affected

11.6(2)ES02
affected

11.6(2)ES01
affected

10.6(1)SU3ES03
affected

11.0(1)SU1ES03
affected

10.6(1)SU3ES01
affected

10.5(1)SU1ES10
affected

10.0(1)SU1ES04
affected

11.5(1)SU1ES03
affected

11.6(1)ES02
affected

11.5(1)ES01
affected

9.0(2)SU3ES04
affected

10.6(1)SU2
affected

10.6(1)SU2ES04
affected

11.6(1)ES01
affected

10.6(1)SU3ES02
affected

11.5(1)SU1ES02
affected

11.5(1)SU1ES01
affected

8.5(1)
affected

11.0(1)SU1ES02
affected

12.5(1)_SU03_ES03
affected

12.5(1)_SU03_ES04
affected

12.5(1)_SU03_ES05
affected

12.5(1)_SU03_ES06
affected

Default status
unknown

11.6(1)
affected

10.5(1)
affected

11.0(1)
affected

11.5(1)
affected

12.0(1)
affected

12.5(1)
affected

11.0(2)
affected

12.6(1)
affected

12.5(1)SU
affected

12.6(1)_ET
affected

12.6(1)_ES05_ET
affected

11.0(3)
affected

12.6(2)
affected

12.6(2)_504_Issue_ET
affected

12.6.1_ExcelIssue_ET
affected

12.6(2)_Permalink_ET
affected

12.6.2_CSCwk19536_ET
affected

12.6.2_CSCwm96922_ET
affected

12.6.2_Amq_OOS_ET
affected

12.5(2)ET_CSCwi79933
affected

12.6(2)_ET
affected

12.6.2_CSCwn48501_ET
affected

References

sec.cloudapps.cisco.com/...y/cisco-sa-cuis-priv-esc-3Pk96SU4 (cisco-sa-cuis-priv-esc-3Pk96SU4)

cve.org (CVE-2025-20114)

nvd.nist.gov (CVE-2025-20114)

Download JSON