CVE-2025-20114: Cisco Unified Intelligence Center Privilege Escalation

CVE-2025-20114 Overview

CVE-2025-20114 is an authenticated horizontal privilege escalation vulnerability in the API of Cisco Unified Intelligence Center. The flaw stems from insufficient validation of user-supplied parameters in API requests, enabling an Insecure Direct Object Reference (IDOR) attack [CWE-639]. An authenticated remote attacker can submit crafted API requests to access data belonging to other users on the affected system. Cisco Unified Contact Center Express is also listed among affected products in the NVD data. The vulnerability requires valid credentials and does not permit modification of data or disruption of service, limiting impact to unauthorized read access across user boundaries.

Critical Impact
An authenticated attacker can retrieve report data and configuration objects associated with other users through crafted API calls, breaching tenant and user-level data isolation in contact center reporting environments.

Affected Products

Cisco Unified Intelligence Center (versions 10.5(1) through 12.6(2), including engineering specials)
Cisco Unified Contact Center Express (versions 8.5(1) through 12.5(1)SU3)
Deployments exposing the CUIC API to authenticated user populations

Discovery Timeline

2025-05-21 - CVE-2025-20114 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-20114

Vulnerability Analysis

The vulnerability is classified as an Insecure Direct Object Reference under [CWE-639]. The Cisco Unified Intelligence Center (CUIC) API accepts user-supplied identifiers referencing resources such as reports, dashboards, and stored objects. The API does not sufficiently verify that the authenticated caller owns or is authorized to access the referenced object identifier. As a result, an attacker who possesses valid low-privileged credentials can substitute another user's object identifier into an API request and receive the corresponding data.

Exploitation requires network reachability to the CUIC API and a valid account, but no user interaction is required. The scope of impact is limited to confidentiality; the attacker cannot alter data or degrade availability through this flaw alone. In multi-tenant or role-segmented reporting deployments, this breaks the assumption that each user's report definitions and query results remain private.

Root Cause

The root cause is missing object-level authorization on API endpoints that accept object identifiers as parameters. The application authenticates the requester but does not perform an ownership or access-control check tying the caller's identity to the requested object before returning data.

Attack Vector

The attack vector is network-based and requires authentication. An attacker with a valid CUIC user account enumerates or guesses object identifiers belonging to other users and issues API requests referencing those identifiers. The API returns data associated with the target user rather than rejecting the request. No public proof-of-concept has been published, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Refer to the Cisco Security Advisory for authoritative endpoint details.

// No verified public exploit code is available.
// The abuse pattern involves substituting a foreign object
// identifier into an authenticated CUIC API request.

Detection Methods for CVE-2025-20114

Indicators of Compromise

Authenticated CUIC API requests where the caller repeatedly references object identifiers not previously associated with that user session.
Sequential or enumerated numeric object IDs appearing in API access logs from a single user account.
Unusual volumes of successful GET requests to report or dashboard endpoints originating from low-privilege accounts.

Detection Strategies

Correlate authenticated API request logs with object ownership records to flag cross-user access patterns.
Alert on any single account accessing report or object identifiers across a broad range of user ownership boundaries within a short time window.
Baseline normal API usage per role and detect deviations, such as agents accessing supervisor-owned reports.

Monitoring Recommendations

Forward CUIC and Unified Contact Center Express application and API logs to a centralized SIEM for retention and correlation.
Monitor for authentication anomalies preceding API enumeration activity, including credential stuffing or brute-force attempts against CUIC accounts.
Track privileged report content and PII exposure through periodic access-review reporting.

How to Mitigate CVE-2025-20114

Immediate Actions Required

Review the Cisco Security Advisory cisco-sa-cuis-priv-esc-3Pk96SU4 and apply the fixed release identified for your deployment.
Inventory all Cisco Unified Intelligence Center and Unified Contact Center Express instances against the affected version list.
Audit CUIC user accounts, disable unused accounts, and rotate credentials for accounts with weak or shared passwords.

Patch Information

Cisco has published guidance and fixed software information in the security advisory cisco-sa-cuis-priv-esc-3Pk96SU4. Administrators should upgrade to the fixed release identified by Cisco for their specific CUIC or Unified Contact Center Express version. No vendor-supplied workaround is described in the referenced advisory data.

Workarounds

Restrict network access to the CUIC API to trusted management networks and administrative jump hosts.
Enforce least-privilege role assignments so that agent accounts cannot reach reporting APIs beyond their operational needs.
Require strong authentication and monitor for anomalous authenticated API traffic until patches are deployed.

bash

# Example: restrict inbound access to the CUIC management interface
# using an upstream firewall or ACL (illustrative, adapt to environment)
access-list CUIC_ADMIN permit tcp <admin_subnet> host <cuic_ip> eq 443
access-list CUIC_ADMIN deny   tcp any host <cuic_ip> eq 443