CVE-2025-20288 — Cisco Unified Intelligence Center Server-Side Request Forgery Vulnerability

Description (CNA)

A vulnerability in the web-based management interface of Cisco Unified Intelligence Center could allow an unauthenticated, remote attacker to conduct a server-side request forgery (SSRF) attack through an affected device. This vulnerability is due to improper input validation for specific HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to send arbitrary network requests that are sourced from the affected device.

Affected (CNA)

Vendor / product	Versions
Cisco / Cisco Unified Contact Center Express	affected 10.6(1); affected 10.5(1)SU1; affected 10.6(1)SU3; affected 12.0(1); affected 10.6(1)SU1; affected 11.0(1)SU1; affected 11.5(1)SU1; affected 10.5(1); affected 11.6(1); affected 11.6(2); affected 12.5(1); affected 12.5(1)SU1; affected 12.5(1)SU2; affected 12.5(1)SU3; affected 12.5(1)_SU03_ES01; affected 12.5(1)_SU03_ES02; affected 12.5(1)_SU02_ES03; affected 12.5(1)_SU02_ES04; affected 12.5(1)_SU02_ES02; affected 12.5(1)_SU01_ES02; affected 12.5(1)_SU01_ES03; affected 12.5(1)_SU02_ES01; affected 11.6(2)ES07; affected 11.6(2)ES08; affected 12.5(1)_SU01_ES01; affected 12.0(1)ES04; affected 12.5(1)ES02; affected 12.5(1)ES03; affected 11.6(2)ES06; affected 12.5(1)ES01; affected 12.0(1)ES03; affected 12.0(1)ES01; affected 11.6(2)ES05; affected 12.0(1)ES02; affected 11.6(2)ES04; affected 11.6(2)ES03; affected 11.6(2)ES02; affected 11.6(2)ES01; affected 10.6(1)SU3ES03; affected 11.0(1)SU1ES03; affected 10.6(1)SU3ES01; affected 10.5(1)SU1ES10; affected 11.5(1)SU1ES03; affected 11.6(1)ES02; affected 11.5(1)ES01; affected 10.6(1)SU2; affected 10.6(1)SU2ES04; affected 11.6(1)ES01; affected 10.6(1)SU3ES02; affected 11.5(1)SU1ES02; affected 11.5(1)SU1ES01; affected 11.0(1)SU1ES02; affected 12.5(1)_SU03_ES03; affected 12.5(1)_SU03_ES04; affected 12.5(1)_SU03_ES05; affected 12.5(1)_SU03_ES06
Cisco / Cisco Unified Intelligence Center	affected 11.6(1); affected 10.5(1); affected 11.0(1); affected 11.5(1); affected 12.0(1); affected 12.5(1); affected 11.0(2); affected 12.6(1); affected 12.5(1)SU; affected 12.6(1)_ET; affected 12.6(1)_ES05_ET; affected 11.0(3); affected 12.6(2); affected 12.6(2)_504_Issue_ET; affected 12.6.1_ExcelIssue_ET; affected 12.6(2)_Permalink_ET; affected 12.6.2_CSCwk19536_ET; affected 12.6.2_CSCwm96922_ET; affected 12.6.2_Amq_OOS_ET; affected 12.5(2)ET_CSCwi79933; affected 12.6(2)_ET; affected 12.6.2_CSCwn48501_ET

Vendor / product

Versions

Cisco / Cisco Unified Contact Center Express

affected 10.6(1); affected 10.5(1)SU1; affected 10.6(1)SU3; affected 12.0(1); affected 10.6(1)SU1; affected 11.0(1)SU1; affected 11.5(1)SU1; affected 10.5(1); affected 11.6(1); affected 11.6(2); affected 12.5(1); affected 12.5(1)SU1; affected 12.5(1)SU2; affected 12.5(1)SU3; affected 12.5(1)_SU03_ES01; affected 12.5(1)_SU03_ES02; affected 12.5(1)_SU02_ES03; affected 12.5(1)_SU02_ES04; affected 12.5(1)_SU02_ES02; affected 12.5(1)_SU01_ES02; affected 12.5(1)_SU01_ES03; affected 12.5(1)_SU02_ES01; affected 11.6(2)ES07; affected 11.6(2)ES08; affected 12.5(1)_SU01_ES01; affected 12.0(1)ES04; affected 12.5(1)ES02; affected 12.5(1)ES03; affected 11.6(2)ES06; affected 12.5(1)ES01; affected 12.0(1)ES03; affected 12.0(1)ES01; affected 11.6(2)ES05; affected 12.0(1)ES02; affected 11.6(2)ES04; affected 11.6(2)ES03; affected 11.6(2)ES02; affected 11.6(2)ES01; affected 10.6(1)SU3ES03; affected 11.0(1)SU1ES03; affected 10.6(1)SU3ES01; affected 10.5(1)SU1ES10; affected 11.5(1)SU1ES03; affected 11.6(1)ES02; affected 11.5(1)ES01; affected 10.6(1)SU2; affected 10.6(1)SU2ES04; affected 11.6(1)ES01; affected 10.6(1)SU3ES02; affected 11.5(1)SU1ES02; affected 11.5(1)SU1ES01; affected 11.0(1)SU1ES02; affected 12.5(1)_SU03_ES03; affected 12.5(1)_SU03_ES04; affected 12.5(1)_SU03_ES05; affected 12.5(1)_SU03_ES06

Cisco / Cisco Unified Intelligence Center

affected 11.6(1); affected 10.5(1); affected 11.0(1); affected 11.5(1); affected 12.0(1); affected 12.5(1); affected 11.0(2); affected 12.6(1); affected 12.5(1)SU; affected 12.6(1)_ET; affected 12.6(1)_ES05_ET; affected 11.0(3); affected 12.6(2); affected 12.6(2)_504_Issue_ET; affected 12.6.1_ExcelIssue_ET; affected 12.6(2)_Permalink_ET; affected 12.6.2_CSCwk19536_ET; affected 12.6.2_CSCwm96922_ET; affected 12.6.2_Amq_OOS_ET; affected 12.5(2)ET_CSCwi79933; affected 12.6(2)_ET; affected 12.6.2_CSCwn48501_ET

CWE

CWE-918

References

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cuis-ssrf-JSuDjeV

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.