Cisco Unified Intelligence Center API Information Disclosure Vulnerability (Cisco Cisco Packaged Contact Center Enterprise)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.27 % · percentile 20 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- cisco
- NVD status
- Deferred
Description
A vulnerability in the API subsystem of Cisco Unified Intelligence Center could allow an authenticated, remote attacker to obtain sensitive information from an affected system. This vulnerability is due to improper validation of requests to certain API endpoints. An attacker could exploit this vulnerability by sending a valid request to a specific API endpoint within the affected system. A successful exploit could allow a low-privileged user to view sensitive information on the affected system that should be restricted. To exploit this vulnerability, the attacker must have valid user credentials on the affected system.
Weaknesses (CWE)
- CWE-200 — Exposure of Sensitive Information to an Unauthorized Actor
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N | cisco |
| CVSS 3.1 | MEDIUM 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N | NVD · psirt@cisco.com (Secondary) |
European references
- ENISA EUVD · EUVD-2025-37887
- GCVE · GCVE-0-2025-20377
Affected products
| Product | Versions |
|---|---|
| Cisco · Cisco Packaged Contact Center Enterprise | affected 12.5(1) ; affected 11.0(1) ; affected 12.0(1) ; affected 11.0(2) ; affected 11.5(1) ; affected 10.5(1) |
| Cisco · Cisco Unified Contact Center Enterprise | affected 12.6(1)ES3 ; affected 12.6(1)ES1 ; affected 12.6(1) ; affected 12.6(1)ES2 ; affected 12.6(1)SecurityPatch ; affected 12.5(1)ES1 |
| Cisco · Cisco Unified Contact Center Express | affected 10.5(1)SU1 ; affected 10.6(1) ; affected 11.6(1) ; affected 10.6(1)SU1 ; affected 10.6(1)SU3 ; affected 11.6(2) |
| Cisco · Cisco Unified Intelligence Center | affected 11.6(1) ; affected 10.5(1) ; affected 11.0(1) ; affected 11.5(1) ; affected 12.0(1) ; affected 12.5(1) |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |