Read the docs
TI-2025-14416 Aliases CVE-2025-20114GHSA-9r82-ff34-6w3x

Cisco Unified Intelligence Center Insecure Direct Object Reference Vulnerability

Priority LOW 22CWE-639Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
Low · None · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-639.

Summary

A vulnerability in the API of Cisco Unified Intelligence Center could allow an authenticated, remote attacker to perform a horizontal privilege escalation attack on an affected system. This vulnerability is due to insufficient validation of user-supplied parameters in API requests. An attacker could exploit this vulnerability by submitting crafted API requests to an affected system to execute an insecure direct object reference attack. A successful exploit could allow the attacker to access specific data that is associated with different users on the affected system.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0035 28th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
CiscoCisco Unified Contact Center Express10.6(1); 10.5(1)SU1; 10.6(1)SU3; 12.0(1); 10.0(1)SU1; 10.6(1)SU1; 11.0(1)SU1; 11.5(1)SU1; 10.5(1); 11.6(1); 11.6(2); 12.5(1); 12.5(1)SU1; 12.5(1)SU2; 12.5(1)SU3; 12.5(1)_SU03_ES01; 12.5(1)_SU03_ES02; 12.5(1)_SU02_ES03; 12.5(1)_SU02_ES04; 12.5(1)_SU02_ES02; 12.5(1)_SU01_ES02; 12.5(1)_SU01_ES03; 12.5(1)_SU02_ES01; 11.6(2)ES07; 11.6(2)ES08; 12.5(1)_SU01_ES01; 12.0(1)ES04; 12.5(1)ES02; 12.5(1)ES03; 11.6(2)ES06; 12.5(1)ES01; 12.0(1)ES03; 12.0(1)ES01; 11.6(2)ES05; 12.0(1)ES02; 11.6(2)ES04; 11.6(2)ES03; 11.6(2)ES02; 11.6(2)ES01; 10.6(1)SU3ES03; 11.0(1)SU1ES03; 10.6(1)SU3ES01; 10.5(1)SU1ES10; 10.0(1)SU1ES04; 11.5(1)SU1ES03; 11.6(1)ES02; 11.5(1)ES01; 9.0(2)SU3ES04; 10.6(1)SU2; 10.6(1)SU2ES04; 11.6(1)ES01; 10.6(1)SU3ES02; 11.5(1)SU1ES02; 11.5(1)SU1ES01; 8.5(1); 11.0(1)SU1ES02; 12.5(1)_SU03_ES03; 12.5(1)_SU03_ES04; 12.5(1)_SU03_ES05; 12.5(1)_SU03_ES06—No fix listedCNA
CiscoCisco Unified Intelligence Center11.6(1); 10.5(1); 11.0(1); 11.5(1); 12.0(1); 12.5(1); 11.0(2); 12.6(1); 12.5(1)SU; 12.6(1)_ET; 12.6(1)_ES05_ET; 11.0(3); 12.6(2); 12.6(2)_504_Issue_ET; 12.6.1_ExcelIssue_ET; 12.6(2)_Permalink_ET; 12.6.2_CSCwk19536_ET; 12.6.2_CSCwm96922_ET; 12.6.2_Amq_OOS_ET; 12.5(2)ET_CSCwi79933; 12.6(2)_ET; 12.6.2_CSCwn48501_ET—No fix listedCNA
  • Cisco Unified Contact Center Express VendorCisco Affected 10.6(1); 10.5(1)SU1; 10.6(1)SU3; 12.0(1); 10.0(1)SU1; 10.6(1)SU1; 11.0(1)SU1; 11.5(1)SU1; 10.5(1); 11.6(1); 11.6(2); 12.5(1); 12.5(1)SU1; 12.5(1)SU2; 12.5(1)SU3; 12.5(1)_SU03_ES01; 12.5(1)_SU03_ES02; 12.5(1)_SU02_ES03; 12.5(1)_SU02_ES04; 12.5(1)_SU02_ES02; 12.5(1)_SU01_ES02; 12.5(1)_SU01_ES03; 12.5(1)_SU02_ES01; 11.6(2)ES07; 11.6(2)ES08; 12.5(1)_SU01_ES01; 12.0(1)ES04; 12.5(1)ES02; 12.5(1)ES03; 11.6(2)ES06; 12.5(1)ES01; 12.0(1)ES03; 12.0(1)ES01; 11.6(2)ES05; 12.0(1)ES02; 11.6(2)ES04; 11.6(2)ES03; 11.6(2)ES02; 11.6(2)ES01; 10.6(1)SU3ES03; 11.0(1)SU1ES03; 10.6(1)SU3ES01; 10.5(1)SU1ES10; 10.0(1)SU1ES04; 11.5(1)SU1ES03; 11.6(1)ES02; 11.5(1)ES01; 9.0(2)SU3ES04; 10.6(1)SU2; 10.6(1)SU2ES04; 11.6(1)ES01; 10.6(1)SU3ES02; 11.5(1)SU1ES02; 11.5(1)SU1ES01; 8.5(1); 11.0(1)SU1ES02; 12.5(1)_SU03_ES03; 12.5(1)_SU03_ES04; 12.5(1)_SU03_ES05; 12.5(1)_SU03_ES06 Fixed in — No fix listed CNA
  • Cisco Unified Intelligence Center VendorCisco Affected 11.6(1); 10.5(1); 11.0(1); 11.5(1); 12.0(1); 12.5(1); 11.0(2); 12.6(1); 12.5(1)SU; 12.6(1)_ET; 12.6(1)_ES05_ET; 11.0(3); 12.6(2); 12.6(2)_504_Issue_ET; 12.6.1_ExcelIssue_ET; 12.6(2)_Permalink_ET; 12.6.2_CSCwk19536_ET; 12.6.2_CSCwm96922_ET; 12.6.2_Amq_OOS_ET; 12.5(2)ET_CSCwi79933; 12.6(2)_ET; 12.6.2_CSCwn48501_ET Fixed in — No fix listed CNA

CPE configurations NVD · 73

CPEVersionsRoleVendor
cpe:2.3:a:cisco:unified_intelligence_center:10.5\(1\):*:*:*:*:*:*:*10.5(1)VulnerableCisco
cpe:2.3:a:cisco:unified_intelligence_center:11.0\(1\):*:*:*:*:*:*:*11.0(1)VulnerableCisco
cpe:2.3:a:cisco:unified_intelligence_center:11.0\(2\):*:*:*:*:*:*:*11.0(2)VulnerableCisco
cpe:2.3:a:cisco:unified_intelligence_center:11.0\(3\):*:*:*:*:*:*:*11.0(3)VulnerableCisco
cpe:2.3:a:cisco:unified_intelligence_center:11.5\(1\):*:*:*:*:*:*:*11.5(1)VulnerableCisco
cpe:2.3:a:cisco:unified_intelligence_center:11.6\(1\):*:*:*:*:*:*:*11.6(1)VulnerableCisco
cpe:2.3:a:cisco:unified_intelligence_center:12.0\(1\):*:*:*:*:*:*:*12.0(1)VulnerableCisco
cpe:2.3:a:cisco:unified_intelligence_center:12.5\(1\):*:*:*:*:*:*:*12.5(1)VulnerableCisco
cpe:2.3:a:cisco:unified_intelligence_center:12.5\(1\)su:*:*:*:*:*:*:*12.5(1)suVulnerableCisco
cpe:2.3:a:cisco:unified_intelligence_center:12.6\(1\):*:*:*:*:*:*:*12.6(1)VulnerableCisco
  • cpe:2.3:a:cisco:unified_intelligence_center:10.5\(1\):*:*:*:*:*:*:* Versions 10.5(1) Vulnerable ·Cisco
  • cpe:2.3:a:cisco:unified_intelligence_center:11.0\(1\):*:*:*:*:*:*:* Versions 11.0(1) Vulnerable ·Cisco
  • cpe:2.3:a:cisco:unified_intelligence_center:11.0\(2\):*:*:*:*:*:*:* Versions 11.0(2) Vulnerable ·Cisco
  • cpe:2.3:a:cisco:unified_intelligence_center:11.0\(3\):*:*:*:*:*:*:* Versions 11.0(3) Vulnerable ·Cisco
  • cpe:2.3:a:cisco:unified_intelligence_center:11.5\(1\):*:*:*:*:*:*:* Versions 11.5(1) Vulnerable ·Cisco
  • cpe:2.3:a:cisco:unified_intelligence_center:11.6\(1\):*:*:*:*:*:*:* Versions 11.6(1) Vulnerable ·Cisco
  • cpe:2.3:a:cisco:unified_intelligence_center:12.0\(1\):*:*:*:*:*:*:* Versions 12.0(1) Vulnerable ·Cisco
  • cpe:2.3:a:cisco:unified_intelligence_center:12.5\(1\):*:*:*:*:*:*:* Versions 12.5(1) Vulnerable ·Cisco
  • cpe:2.3:a:cisco:unified_intelligence_center:12.5\(1\)su:*:*:*:*:*:*:* Versions 12.5(1)su Vulnerable ·Cisco
  • cpe:2.3:a:cisco:unified_intelligence_center:12.6\(1\):*:*:*:*:*:*:* Versions 12.6(1) Vulnerable ·Cisco
Show 63 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:cisco:unified_intelligence_center:12.6\(1\)_es05_et:*:*:*:*:*:*:*12.6(1)_es05_etVulnerableCisco
cpe:2.3:a:cisco:unified_intelligence_center:12.6\(1\)_et:*:*:*:*:*:*:*12.6(1)_etVulnerableCisco
cpe:2.3:a:cisco:unified_intelligence_center:12.6\(2\):*:*:*:*:*:*:*12.6(2)VulnerableCisco
cpe:2.3:a:cisco:unified_contact_center_express:8.5\(1\):*:*:*:*:*:*:*8.5(1)VulnerableCisco
cpe:2.3:a:cisco:unified_contact_center_express:9.0\(2\)su3es04:*:*:*:*:*:*:*9.0(2)su3es04VulnerableCisco
cpe:2.3:a:cisco:unified_contact_center_express:10.0\(1\)su1:*:*:*:*:*:*:*10.0(1)su1VulnerableCisco
cpe:2.3:a:cisco:unified_contact_center_express:10.0\(1\)su1es04:*:*:*:*:*:*:*10.0(1)su1es04VulnerableCisco
cpe:2.3:a:cisco:unified_contact_center_express:10.5\(1\):*:*:*:*:*:*:*10.5(1)VulnerableCisco
cpe:2.3:a:cisco:unified_contact_center_express:10.5\(1\)su1:*:*:*:*:*:*:*10.5(1)su1VulnerableCisco
cpe:2.3:a:cisco:unified_contact_center_express:10.5\(1\)su1es10:*:*:*:*:*:*:*10.5(1)su1es10VulnerableCisco
cpe:2.3:a:cisco:unified_contact_center_express:10.6\(1\):*:*:*:*:*:*:*10.6(1)VulnerableCisco
cpe:2.3:a:cisco:unified_contact_center_express:10.6\(1\)su1:*:*:*:*:*:*:*10.6(1)su1VulnerableCisco
cpe:2.3:a:cisco:unified_contact_center_express:10.6\(1\)su2:*:*:*:*:*:*:*10.6(1)su2VulnerableCisco
cpe:2.3:a:cisco:unified_contact_center_express:10.6\(1\)su2es04:*:*:*:*:*:*:*10.6(1)su2es04VulnerableCisco
cpe:2.3:a:cisco:unified_contact_center_express:10.6\(1\)su3:*:*:*:*:*:*:*10.6(1)su3VulnerableCisco
cpe:2.3:a:cisco:unified_contact_center_express:10.6\(1\)su3es01:*:*:*:*:*:*:*10.6(1)su3es01VulnerableCisco
cpe:2.3:a:cisco:unified_contact_center_express:10.6\(1\)su3es02:*:*:*:*:*:*:*10.6(1)su3es02VulnerableCisco
cpe:2.3:a:cisco:unified_contact_center_express:10.6\(1\)su3es03:*:*:*:*:*:*:*10.6(1)su3es03VulnerableCisco
cpe:2.3:a:cisco:unified_contact_center_express:11.0\(1\)su1:*:*:*:*:*:*:*11.0(1)su1VulnerableCisco
cpe:2.3:a:cisco:unified_contact_center_express:11.0\(1\)su1es02:*:*:*:*:*:*:*11.0(1)su1es02VulnerableCisco
cpe:2.3:a:cisco:unified_contact_center_express:11.0\(1\)su1es03:*:*:*:*:*:*:*11.0(1)su1es03VulnerableCisco
cpe:2.3:a:cisco:unified_contact_center_express:11.5\(1\)es01:*:*:*:*:*:*:*11.5(1)es01VulnerableCisco
cpe:2.3:a:cisco:unified_contact_center_express:11.5\(1\)su1:*:*:*:*:*:*:*11.5(1)su1VulnerableCisco
cpe:2.3:a:cisco:unified_contact_center_express:11.5\(1\)su1es01:*:*:*:*:*:*:*11.5(1)su1es01VulnerableCisco
cpe:2.3:a:cisco:unified_contact_center_express:11.5\(1\)su1es02:*:*:*:*:*:*:*11.5(1)su1es02VulnerableCisco
cpe:2.3:a:cisco:unified_contact_center_express:11.5\(1\)su1es03:*:*:*:*:*:*:*11.5(1)su1es03VulnerableCisco
cpe:2.3:a:cisco:unified_contact_center_express:11.6\(1\):*:*:*:*:*:*:*11.6(1)VulnerableCisco
cpe:2.3:a:cisco:unified_contact_center_express:11.6\(1\)es01:*:*:*:*:*:*:*11.6(1)es01VulnerableCisco
cpe:2.3:a:cisco:unified_contact_center_express:11.6\(1\)es02:*:*:*:*:*:*:*11.6(1)es02VulnerableCisco
cpe:2.3:a:cisco:unified_contact_center_express:11.6\(2\):*:*:*:*:*:*:*11.6(2)VulnerableCisco
cpe:2.3:a:cisco:unified_contact_center_express:11.6\(2\)es01:*:*:*:*:*:*:*11.6(2)es01VulnerableCisco
cpe:2.3:a:cisco:unified_contact_center_express:11.6\(2\)es02:*:*:*:*:*:*:*11.6(2)es02VulnerableCisco
cpe:2.3:a:cisco:unified_contact_center_express:11.6\(2\)es03:*:*:*:*:*:*:*11.6(2)es03VulnerableCisco
cpe:2.3:a:cisco:unified_contact_center_express:11.6\(2\)es04:*:*:*:*:*:*:*11.6(2)es04VulnerableCisco
cpe:2.3:a:cisco:unified_contact_center_express:11.6\(2\)es05:*:*:*:*:*:*:*11.6(2)es05VulnerableCisco
cpe:2.3:a:cisco:unified_contact_center_express:11.6\(2\)es06:*:*:*:*:*:*:*11.6(2)es06VulnerableCisco
cpe:2.3:a:cisco:unified_contact_center_express:11.6\(2\)es07:*:*:*:*:*:*:*11.6(2)es07VulnerableCisco
cpe:2.3:a:cisco:unified_contact_center_express:11.6\(2\)es08:*:*:*:*:*:*:*11.6(2)es08VulnerableCisco
cpe:2.3:a:cisco:unified_contact_center_express:12.0\(1\):*:*:*:*:*:*:*12.0(1)VulnerableCisco
cpe:2.3:a:cisco:unified_contact_center_express:12.0\(1\)es01:*:*:*:*:*:*:*12.0(1)es01VulnerableCisco
cpe:2.3:a:cisco:unified_contact_center_express:12.0\(1\)es02:*:*:*:*:*:*:*12.0(1)es02VulnerableCisco
cpe:2.3:a:cisco:unified_contact_center_express:12.0\(1\)es03:*:*:*:*:*:*:*12.0(1)es03VulnerableCisco
cpe:2.3:a:cisco:unified_contact_center_express:12.0\(1\)es04:*:*:*:*:*:*:*12.0(1)es04VulnerableCisco
cpe:2.3:a:cisco:unified_contact_center_express:12.5\(1\):*:*:*:*:*:*:*12.5(1)VulnerableCisco
cpe:2.3:a:cisco:unified_contact_center_express:12.5\(1\)_su01_es01:*:*:*:*:*:*:*12.5(1)_su01_es01VulnerableCisco
cpe:2.3:a:cisco:unified_contact_center_express:12.5\(1\)_su01_es02:*:*:*:*:*:*:*12.5(1)_su01_es02VulnerableCisco
cpe:2.3:a:cisco:unified_contact_center_express:12.5\(1\)_su01_es03:*:*:*:*:*:*:*12.5(1)_su01_es03VulnerableCisco
cpe:2.3:a:cisco:unified_contact_center_express:12.5\(1\)_su02_es01:*:*:*:*:*:*:*12.5(1)_su02_es01VulnerableCisco
cpe:2.3:a:cisco:unified_contact_center_express:12.5\(1\)_su02_es02:*:*:*:*:*:*:*12.5(1)_su02_es02VulnerableCisco
cpe:2.3:a:cisco:unified_contact_center_express:12.5\(1\)_su02_es03:*:*:*:*:*:*:*12.5(1)_su02_es03VulnerableCisco
cpe:2.3:a:cisco:unified_contact_center_express:12.5\(1\)_su02_es04:*:*:*:*:*:*:*12.5(1)_su02_es04VulnerableCisco
cpe:2.3:a:cisco:unified_contact_center_express:12.5\(1\)_su03_es01:*:*:*:*:*:*:*12.5(1)_su03_es01VulnerableCisco
cpe:2.3:a:cisco:unified_contact_center_express:12.5\(1\)_su03_es02:*:*:*:*:*:*:*12.5(1)_su03_es02VulnerableCisco
cpe:2.3:a:cisco:unified_contact_center_express:12.5\(1\)_su03_es03:*:*:*:*:*:*:*12.5(1)_su03_es03VulnerableCisco
cpe:2.3:a:cisco:unified_contact_center_express:12.5\(1\)_su03_es04:*:*:*:*:*:*:*12.5(1)_su03_es04VulnerableCisco
cpe:2.3:a:cisco:unified_contact_center_express:12.5\(1\)_su03_es05:*:*:*:*:*:*:*12.5(1)_su03_es05VulnerableCisco
cpe:2.3:a:cisco:unified_contact_center_express:12.5\(1\)_su03_es06:*:*:*:*:*:*:*12.5(1)_su03_es06VulnerableCisco
cpe:2.3:a:cisco:unified_contact_center_express:12.5\(1\)es01:*:*:*:*:*:*:*12.5(1)es01VulnerableCisco
cpe:2.3:a:cisco:unified_contact_center_express:12.5\(1\)es02:*:*:*:*:*:*:*12.5(1)es02VulnerableCisco
cpe:2.3:a:cisco:unified_contact_center_express:12.5\(1\)es03:*:*:*:*:*:*:*12.5(1)es03VulnerableCisco
cpe:2.3:a:cisco:unified_contact_center_express:12.5\(1\)su1:*:*:*:*:*:*:*12.5(1)su1VulnerableCisco
cpe:2.3:a:cisco:unified_contact_center_express:12.5\(1\)su2:*:*:*:*:*:*:*12.5(1)su2VulnerableCisco
cpe:2.3:a:cisco:unified_contact_center_express:12.5\(1\)su3:*:*:*:*:*:*:*12.5(1)su3VulnerableCisco
  • cpe:2.3:a:cisco:unified_intelligence_center:12.6\(1\)_es05_et:*:*:*:*:*:*:* Versions 12.6(1)_es05_et Vulnerable ·Cisco
  • cpe:2.3:a:cisco:unified_intelligence_center:12.6\(1\)_et:*:*:*:*:*:*:* Versions 12.6(1)_et Vulnerable ·Cisco
  • cpe:2.3:a:cisco:unified_intelligence_center:12.6\(2\):*:*:*:*:*:*:* Versions 12.6(2) Vulnerable ·Cisco
  • cpe:2.3:a:cisco:unified_contact_center_express:8.5\(1\):*:*:*:*:*:*:* Versions 8.5(1) Vulnerable ·Cisco
  • cpe:2.3:a:cisco:unified_contact_center_express:9.0\(2\)su3es04:*:*:*:*:*:*:* Versions 9.0(2)su3es04 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:unified_contact_center_express:10.0\(1\)su1:*:*:*:*:*:*:* Versions 10.0(1)su1 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:unified_contact_center_express:10.0\(1\)su1es04:*:*:*:*:*:*:* Versions 10.0(1)su1es04 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:unified_contact_center_express:10.5\(1\):*:*:*:*:*:*:* Versions 10.5(1) Vulnerable ·Cisco
  • cpe:2.3:a:cisco:unified_contact_center_express:10.5\(1\)su1:*:*:*:*:*:*:* Versions 10.5(1)su1 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:unified_contact_center_express:10.5\(1\)su1es10:*:*:*:*:*:*:* Versions 10.5(1)su1es10 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:unified_contact_center_express:10.6\(1\):*:*:*:*:*:*:* Versions 10.6(1) Vulnerable ·Cisco
  • cpe:2.3:a:cisco:unified_contact_center_express:10.6\(1\)su1:*:*:*:*:*:*:* Versions 10.6(1)su1 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:unified_contact_center_express:10.6\(1\)su2:*:*:*:*:*:*:* Versions 10.6(1)su2 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:unified_contact_center_express:10.6\(1\)su2es04:*:*:*:*:*:*:* Versions 10.6(1)su2es04 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:unified_contact_center_express:10.6\(1\)su3:*:*:*:*:*:*:* Versions 10.6(1)su3 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:unified_contact_center_express:10.6\(1\)su3es01:*:*:*:*:*:*:* Versions 10.6(1)su3es01 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:unified_contact_center_express:10.6\(1\)su3es02:*:*:*:*:*:*:* Versions 10.6(1)su3es02 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:unified_contact_center_express:10.6\(1\)su3es03:*:*:*:*:*:*:* Versions 10.6(1)su3es03 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:unified_contact_center_express:11.0\(1\)su1:*:*:*:*:*:*:* Versions 11.0(1)su1 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:unified_contact_center_express:11.0\(1\)su1es02:*:*:*:*:*:*:* Versions 11.0(1)su1es02 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:unified_contact_center_express:11.0\(1\)su1es03:*:*:*:*:*:*:* Versions 11.0(1)su1es03 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:unified_contact_center_express:11.5\(1\)es01:*:*:*:*:*:*:* Versions 11.5(1)es01 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:unified_contact_center_express:11.5\(1\)su1:*:*:*:*:*:*:* Versions 11.5(1)su1 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:unified_contact_center_express:11.5\(1\)su1es01:*:*:*:*:*:*:* Versions 11.5(1)su1es01 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:unified_contact_center_express:11.5\(1\)su1es02:*:*:*:*:*:*:* Versions 11.5(1)su1es02 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:unified_contact_center_express:11.5\(1\)su1es03:*:*:*:*:*:*:* Versions 11.5(1)su1es03 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:unified_contact_center_express:11.6\(1\):*:*:*:*:*:*:* Versions 11.6(1) Vulnerable ·Cisco
  • cpe:2.3:a:cisco:unified_contact_center_express:11.6\(1\)es01:*:*:*:*:*:*:* Versions 11.6(1)es01 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:unified_contact_center_express:11.6\(1\)es02:*:*:*:*:*:*:* Versions 11.6(1)es02 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:unified_contact_center_express:11.6\(2\):*:*:*:*:*:*:* Versions 11.6(2) Vulnerable ·Cisco
  • cpe:2.3:a:cisco:unified_contact_center_express:11.6\(2\)es01:*:*:*:*:*:*:* Versions 11.6(2)es01 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:unified_contact_center_express:11.6\(2\)es02:*:*:*:*:*:*:* Versions 11.6(2)es02 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:unified_contact_center_express:11.6\(2\)es03:*:*:*:*:*:*:* Versions 11.6(2)es03 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:unified_contact_center_express:11.6\(2\)es04:*:*:*:*:*:*:* Versions 11.6(2)es04 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:unified_contact_center_express:11.6\(2\)es05:*:*:*:*:*:*:* Versions 11.6(2)es05 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:unified_contact_center_express:11.6\(2\)es06:*:*:*:*:*:*:* Versions 11.6(2)es06 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:unified_contact_center_express:11.6\(2\)es07:*:*:*:*:*:*:* Versions 11.6(2)es07 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:unified_contact_center_express:11.6\(2\)es08:*:*:*:*:*:*:* Versions 11.6(2)es08 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:unified_contact_center_express:12.0\(1\):*:*:*:*:*:*:* Versions 12.0(1) Vulnerable ·Cisco
  • cpe:2.3:a:cisco:unified_contact_center_express:12.0\(1\)es01:*:*:*:*:*:*:* Versions 12.0(1)es01 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:unified_contact_center_express:12.0\(1\)es02:*:*:*:*:*:*:* Versions 12.0(1)es02 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:unified_contact_center_express:12.0\(1\)es03:*:*:*:*:*:*:* Versions 12.0(1)es03 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:unified_contact_center_express:12.0\(1\)es04:*:*:*:*:*:*:* Versions 12.0(1)es04 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:unified_contact_center_express:12.5\(1\):*:*:*:*:*:*:* Versions 12.5(1) Vulnerable ·Cisco
  • cpe:2.3:a:cisco:unified_contact_center_express:12.5\(1\)_su01_es01:*:*:*:*:*:*:* Versions 12.5(1)_su01_es01 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:unified_contact_center_express:12.5\(1\)_su01_es02:*:*:*:*:*:*:* Versions 12.5(1)_su01_es02 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:unified_contact_center_express:12.5\(1\)_su01_es03:*:*:*:*:*:*:* Versions 12.5(1)_su01_es03 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:unified_contact_center_express:12.5\(1\)_su02_es01:*:*:*:*:*:*:* Versions 12.5(1)_su02_es01 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:unified_contact_center_express:12.5\(1\)_su02_es02:*:*:*:*:*:*:* Versions 12.5(1)_su02_es02 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:unified_contact_center_express:12.5\(1\)_su02_es03:*:*:*:*:*:*:* Versions 12.5(1)_su02_es03 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:unified_contact_center_express:12.5\(1\)_su02_es04:*:*:*:*:*:*:* Versions 12.5(1)_su02_es04 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:unified_contact_center_express:12.5\(1\)_su03_es01:*:*:*:*:*:*:* Versions 12.5(1)_su03_es01 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:unified_contact_center_express:12.5\(1\)_su03_es02:*:*:*:*:*:*:* Versions 12.5(1)_su03_es02 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:unified_contact_center_express:12.5\(1\)_su03_es03:*:*:*:*:*:*:* Versions 12.5(1)_su03_es03 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:unified_contact_center_express:12.5\(1\)_su03_es04:*:*:*:*:*:*:* Versions 12.5(1)_su03_es04 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:unified_contact_center_express:12.5\(1\)_su03_es05:*:*:*:*:*:*:* Versions 12.5(1)_su03_es05 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:unified_contact_center_express:12.5\(1\)_su03_es06:*:*:*:*:*:*:* Versions 12.5(1)_su03_es06 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:unified_contact_center_express:12.5\(1\)es01:*:*:*:*:*:*:* Versions 12.5(1)es01 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:unified_contact_center_express:12.5\(1\)es02:*:*:*:*:*:*:* Versions 12.5(1)es02 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:unified_contact_center_express:12.5\(1\)es03:*:*:*:*:*:*:* Versions 12.5(1)es03 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:unified_contact_center_express:12.5\(1\)su1:*:*:*:*:*:*:* Versions 12.5(1)su1 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:unified_contact_center_express:12.5\(1\)su2:*:*:*:*:*:*:* Versions 12.5(1)su2 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:unified_contact_center_express:12.5\(1\)su3:*:*:*:*:*:*:* Versions 12.5(1)su3 Vulnerable ·Cisco

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-20114
  2. 2026-10-03 Alias added: GHSA-9r82-ff34-6w3x

References

Advisory 1

  • TI-2021-19919 Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints KEVCVSS 3.1CRITICAL 10.0
  • TI-2020-02838 Cisco Unified Contact Center Express Remote Code Execution Vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2018-00362 Cross-site scripting in Cisco Unified Contact Center Express unknown CVSS 3.0CRITICAL 9.8
  • TI-2024-13188 Deserialization of untrusted data in Cisco Unified Contact Center Enterprise CVSS 3.1CRITICAL 10.0
  • TI-2025-14653 Cisco Unified Contact Center Express Editor Authentication Bypass Vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2017-09109 Improper authentication in Cisco Voice Operating System CVSS 3.0CRITICAL 9.8
See all 47 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences