CVE-2025-20377
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
A vulnerability in the API subsystem of Cisco Unified Intelligence Center could allow an authenticated, remote attacker to obtain sensitive information from an affected system. This is due to improper validation of requests to certain API endpoints. An attacker could exploit this by sending a valid request to a specific API endpoint.
Risk Assessment
A low-privileged user could view sensitive information that should be restricted. This requires valid user credentials on the affected system.
Recommendation
Update Cisco Unified Intelligence Center to a patched version. Review user permissions and monitor API access.
Other vulnerabilities in Cisco Unified Intelligence Center
See all- CVE-2017-12253High
A vulnerability in the Cisco Unified Intelligence Center allows an unauthenticated, remote attacker to execute unwanted actions. The issue is due to a lack of cross-site request forgery (CSRF) protection.
- CVE-2026-20327Medium
A vulnerability in the web-based management interface of Cisco Unified Intelligence Center could allow an authenticated, local attacker to perform a blind SQL injection attack against an affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted request to the web-based management interface. A successful exploit could allow the attacker to read the contents of the internal database of an affected device. To exploit this vulnerability, the attacker must have valid user credentials on the affected device.
Original NVD description (English source)
A vulnerability in the API subsystem of Cisco Unified Intelligence Center could allow an authenticated, remote attacker to obtain sensitive information from an affected system. This vulnerability is due to improper validation of requests to certain API endpoints. An attacker could exploit this vulnerability by sending a valid request to a specific API endpoint within the affected system. A successful exploit could allow a low-privileged user to view sensitive information on the affected system that should be restricted. To exploit this vulnerability, the attacker must have valid user credentials on the affected system.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS