CVE-2025-20113

What it is

A vulnerability in Cisco Unified Intelligence Center could allow an authenticated, remote attacker to elevate privileges to Administrator for a limited set of functions on an affected system. This vulnerability is due to insufficient server-side validation of user-supplied parameters in API or HTTP requests. An attacker could exploit this vulnerability by submitting a crafted API or HTTP request to an affected system. A successful exploit could allow the attacker to access, modify, or delete data beyond the sphere of their intended access level, including obtaining potentially sensitive information stored in the system.

At a glance

Exploitability

Can be exploited over the network with a low-privilege account. High risk of data exposure.

Exploit odds

0.4% chance of exploitation in the next 30 days (EPSS).

Fix

A patch, advisory or fixed version is referenced. Upgrade or apply it.

Timeline

1. 2025-05-21 17:15 UTC PublishedDisclosed publicly on CVE.org and NVD
2. 2026-06-17 08:40 UTC Last updatedMost recent change to the record

Details

Published

2025-05-21 17:15 UTC

Last modified

2026-06-17 08:40 UTC

Exploit probability

0.4% · EPSS, next 30 days

Weakness

CWE-602

Record status

Analyzed

Affected

• Cisco Unified Intelligence Center 10.5\(1\)
• Cisco Unified Intelligence Center 11.0\(1\)
• Cisco Unified Intelligence Center 11.0\(2\)
• Cisco Unified Intelligence Center 11.0\(3\)
• Cisco Unified Intelligence Center 11.5\(1\)
• Cisco Unified Intelligence Center 11.6\(1\)
• Cisco Unified Intelligence Center 12.0\(1\)
• Cisco Unified Intelligence Center 12.5\(1\)

Attack profile CVSS 3.1 · 7.1

Attack vector

Network

Complexity

Low

Privileges needed

Low

User interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None