CVE-2025-20288: Cisco Unified Intelligence Center SSRF Flaw

CVE-2025-20288 Overview

CVE-2025-20288 is a Server-Side Request Forgery (SSRF) vulnerability in the web-based management interface of Cisco Unified Intelligence Center. The flaw allows an unauthenticated, remote attacker to send crafted HTTP requests that cause the affected device to originate arbitrary network requests on the attacker's behalf. The vulnerability stems from improper input validation for specific HTTP requests processed by the management interface. Cisco Unified Contact Center Express deployments that bundle Unified Intelligence Center are also affected.

Critical Impact
An unauthenticated remote attacker can pivot through affected Cisco Unified Intelligence Center devices to reach internal systems, enumerate internal network resources, and interact with services that would otherwise be inaccessible from outside the network.

Affected Products

Cisco Unified Intelligence Center (versions 10.5(1) through 12.6(2))
Cisco Unified Contact Center Express (versions 10.5(1) through 12.5(1)SU3)
Deployments exposing the web-based management interface to untrusted networks

Discovery Timeline

2025-07-16 - CVE-2025-20288 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-20288

Vulnerability Analysis

The vulnerability resides in the web-based management interface of Cisco Unified Intelligence Center. The interface accepts HTTP requests without correctly validating specific input fields that influence outbound request destinations. As a result, an attacker can coerce the server into issuing HTTP requests to attacker-chosen URLs or internal hosts. This category of flaw is tracked as CWE-918 (Server-Side Request Forgery).

Because exploitation requires no authentication and no user interaction, any network-reachable instance of the management interface is at risk. The requests originate from the affected device itself, which typically holds a privileged position on the internal network. Attackers can therefore reach services that trust the appliance, including internal APIs, metadata endpoints, and management planes.

The integrity impact is limited to what the SSRF primitive itself can produce. Confidentiality and availability are unchanged by the flaw directly, but downstream services reached through the SSRF may expose additional data.

Root Cause

The root cause is improper input validation on HTTP request parameters that control server-initiated network operations. The management interface does not enforce an allowlist of valid destinations or reject unexpected schemes and hosts before issuing the outbound request.

Attack Vector

An attacker sends a crafted HTTP request to the exposed web-based management interface of an affected Cisco Unified Intelligence Center device. The server parses the request, extracts the attacker-controlled destination, and issues a new network request originating from itself. Refer to the Cisco Security Advisory cisco-sa-cuis-ssrf-JSuDjeV for the specific request signatures.

No verified public exploit code or proof-of-concept has been published for CVE-2025-20288.

Detection Methods for CVE-2025-20288

Indicators of Compromise

Unexpected outbound HTTP or HTTPS connections originating from Cisco Unified Intelligence Center hosts to internal-only IP ranges, cloud metadata endpoints (169.254.169.254), or unfamiliar external hosts.
HTTP access logs on the management interface showing anomalous request parameters containing URLs, IP addresses, or non-standard schemes.
Requests to the web interface from untrusted or unexpected source addresses immediately preceding outbound traffic spikes from the appliance.

Detection Strategies

Inspect Cisco Unified Intelligence Center HTTP access and application logs for parameter values that resemble URLs (http://, https://, file://, gopher://) submitted by unauthenticated clients.
Correlate inbound requests to the management interface with subsequent outbound connections from the appliance using network flow data or firewall logs.
Deploy signatures on network security controls to flag requests to the vulnerable endpoints described in the Cisco advisory.

Monitoring Recommendations

Baseline normal outbound destinations for Cisco Unified Intelligence Center appliances and alert on deviations.
Monitor for requests from the appliance to RFC1918 addresses, link-local addresses, and cloud metadata services.
Forward web interface logs to a centralized SIEM or data lake and retain them long enough to support incident response investigations.

How to Mitigate CVE-2025-20288

Immediate Actions Required

Identify all Cisco Unified Intelligence Center and Unified Contact Center Express instances in the environment and confirm their versions against the affected list.
Restrict access to the web-based management interface to trusted administrative networks using firewall rules or ACLs.
Apply the fixed software release identified in the Cisco Security Advisory as soon as feasible.

Patch Information

Cisco has published a security advisory (cisco-sa-cuis-ssrf-JSuDjeV) with fixed release information for Cisco Unified Intelligence Center. Administrators should consult the advisory to determine the appropriate upgrade path for their deployed version and apply it through standard Cisco upgrade procedures.

Workarounds

Place the management interface behind a jump host or VPN that requires authenticated access before administrators can reach it.
Apply egress filtering on the Cisco Unified Intelligence Center appliance so it can only reach the specific internal services it requires.
Block outbound access from the appliance to sensitive internal ranges and cloud metadata endpoints where such traffic is not operationally required.

bash

# Example egress control (illustrative iptables reference)
# Deny appliance access to cloud metadata service
iptables -A OUTPUT -d 169.254.169.254 -j DROP
# Restrict outbound HTTP/HTTPS to an approved destination list
iptables -A OUTPUT -p tcp -m multiport --dports 80,443 -d <approved-cidr> -j ACCEPT
iptables -A OUTPUT -p tcp -m multiport --dports 80,443 -j DROP