CVE-2020-3267: A vulnerability in the API subsystem of Cisco Unified Contact Center Express (Unified CCX) could allow an authenticated, remote attacker to change the…

PriorityP337high7.1CVSS 3.1

AVNACLPRLUINSUCNILAH

EPSS

0.81%

52.6th percentile

A vulnerability in the API subsystem of Cisco Unified Contact Center Express (Unified CCX) could allow an authenticated, remote attacker to change the availability state of any agent. The vulnerability is due to insufficient authorization enforcement on an affected system. An attacker could exploit this vulnerability by authenticating to an affected system with valid agent credentials and performing a specific API call with crafted input. A successful exploit could allow the attacker to change the availability state of an agent, potentially causing a denial of service condition.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
cisco	cisco_unified_contact_center_express	—	—
cisco	unified_contact_center_express	< 12.5\(1\)	12.5\(1\)
cisco	unified_contact_center_express	—	—

CVSS provenance

nvdv3.17.1HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

nvdv3.05.4MEDIUMCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

nvdv2.05.5MEDIUMAV:N/AC:L/Au:S/C:N/I:P/A:P

vendor_cisco5.4MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.