Riskcovery

CVE-2025-20288

Cisco Unified Intelligence Center Server-Side Request Forgery Vulnerability

State
Published
Severity
5.8 Medium
Published
Jul 16, 2025
Updated
Jul 18, 2025
Reserved
Oct 10, 2024

Read the record on cve.org

Description

A vulnerability in the web-based management interface of Cisco Unified Intelligence Center could allow an unauthenticated, remote attacker to conduct a server-side request forgery (SSRF) attack through an affected device.

This vulnerability is due to improper input validation for specific HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to send arbitrary network requests that are sourced from the affected device.

Scores

CVSSScoreVectorSource
3.15.8 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:Ncisco

Weaknesses

  • CWE-918 Server-Side Request Forgery (SSRF)

Affected Products

ProductVersions
Cisco Unified Contact Center ExpressCisco
  • 10.6(1)Affected
  • 10.5(1)SU1Affected
  • 10.6(1)SU3Affected
  • 12.0(1)Affected
  • 10.6(1)SU1Affected
  • 11.0(1)SU1Affected
  • 11.5(1)SU1Affected
  • 10.5(1)Affected
  • 11.6(1)Affected
  • 11.6(2)Affected
  • 12.5(1)Affected
  • 12.5(1)SU1Affected
  • 12.5(1)SU2Affected
  • 12.5(1)SU3Affected
  • 12.5(1)_SU03_ES01Affected
  • 12.5(1)_SU03_ES02Affected
  • 12.5(1)_SU02_ES03Affected
  • 12.5(1)_SU02_ES04Affected
  • 12.5(1)_SU02_ES02Affected
  • 12.5(1)_SU01_ES02Affected
  • 12.5(1)_SU01_ES03Affected
  • 12.5(1)_SU02_ES01Affected
  • 11.6(2)ES07Affected
  • 11.6(2)ES08Affected
  • 12.5(1)_SU01_ES01Affected
  • and 31 more versions
Cisco Unified Intelligence CenterCisco
  • 11.6(1)Affected
  • 10.5(1)Affected
  • 11.0(1)Affected
  • 11.5(1)Affected
  • 12.0(1)Affected
  • 12.5(1)Affected
  • 11.0(2)Affected
  • 12.6(1)Affected
  • 12.5(1)SUAffected
  • 12.6(1)_ETAffected
  • 12.6(1)_ES05_ETAffected
  • 11.0(3)Affected
  • 12.6(2)Affected
  • 12.6(2)_504_Issue_ETAffected
  • 12.6.1_ExcelIssue_ETAffected
  • 12.6(2)_Permalink_ETAffected
  • 12.6.2_CSCwk19536_ETAffected
  • 12.6.2_CSCwm96922_ETAffected
  • 12.6.2_Amq_OOS_ETAffected
  • 12.5(2)ET_CSCwi79933Affected
  • 12.6(2)_ETAffected
  • 12.6.2_CSCwn48501_ETAffected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.