CVE-2025-20274
published 2025-07-16CVE-2025-20274: A vulnerability in the web-based management interface of Cisco Unified Intelligence Center could allow an authenticated, remote attacker to upload arbitrary…
PriorityP262high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
0.38%
30.3th percentile
A vulnerability in the web-based management interface of Cisco Unified Intelligence Center could allow an authenticated, remote attacker to upload arbitrary files to an affected device.
This vulnerability is due to improper validation of files that are uploaded to the web-based management interface. An attacker could exploit this vulnerability by uploading arbitrary files to an affected device. A successful exploit could allow the attacker to store malicious files on the system and execute arbitrary commands on the operating system. The Security Impact Rating (SIR) of this advisory has been raised to High because an attacker could elevate privileges to root. To exploit this vulnerability, the attacker must have valid credentials for a user account with at least the role of Report Designer.
Affected
148 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | cisco_unified_contact_center_express | — | — |
| cisco | cisco_unified_contact_center_express | — | — |
| cisco | cisco_unified_contact_center_express | — | — |
| cisco | cisco_unified_contact_center_express | — | — |
| cisco | cisco_unified_contact_center_express | — | — |
| cisco | cisco_unified_contact_center_express | — | — |
| cisco | cisco_unified_contact_center_express | — | — |
| cisco | cisco_unified_contact_center_express | — | — |
| cisco | cisco_unified_contact_center_express | — | — |
| cisco | cisco_unified_contact_center_express | — | — |
| cisco | cisco_unified_contact_center_express | — | — |
| cisco | cisco_unified_contact_center_express | — | — |
| cisco | cisco_unified_contact_center_express | — | — |
| cisco | cisco_unified_contact_center_express | — | — |
| cisco | cisco_unified_contact_center_express | — | — |
| cisco | cisco_unified_contact_center_express | — | — |
| cisco | cisco_unified_contact_center_express | — | — |
| cisco | cisco_unified_contact_center_express | — | — |
| cisco | cisco_unified_contact_center_express | — | — |
| cisco | cisco_unified_contact_center_express | — | — |
| cisco | cisco_unified_contact_center_express | — | — |
| cisco | cisco_unified_contact_center_express | — | — |
| cisco | cisco_unified_contact_center_express | — | — |
| cisco | cisco_unified_contact_center_express | — | — |
| cisco | cisco_unified_contact_center_express | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Exploitation requires an authenticated user with at least the 'Report Designer' role uploading arbitrary files via the web-based management interface of Cisco Unified Intelligence Center. ↗
- →Monitor for arbitrary or unexpected file uploads to the Cisco Unified Intelligence Center web-based management interface, particularly from Report Designer role accounts. ↗
- →Alert on privilege escalation to root following file upload activity on Cisco Unified Intelligence Center systems (CWE-434: Unrestricted Upload of File with Dangerous Type). ↗
- ·No workarounds are available; patching is the only remediation. Track Cisco Bug IDs CSCwn18794 and CSCwn26636 for fix availability. ↗
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vendor_cisco6.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Cisco
Cisco Unified Intelligence Center Arbitrary File Upload Vulnerability
vendor_cisco·2025-07-16·CVSS 6.3
CVE-2025-20274 [MEDIUM] CWE-434 Cisco Unified Intelligence Center Arbitrary File Upload Vulnerability
Cisco Unified Intelligence Center Arbitrary File Upload Vulnerability
A vulnerability in the web-based management interface of Cisco Unified Intelligence Center could allow an authenticated, remote attacker to upload arbitrary files to an affected device.
This vulnerability is due to improper validation of files that are uploaded to the web-based management interface. An attacker could exploit this vulnerability by uploading arbitrary files to an affected device. A successful exploit could allow the attacker to store malicious files on the system and execute arbitrary commands on the operating system. The Security Impact Rating (SIR) of this advisory has been raised to High because an attacker could elevate privileges to root. To exploit this vulnerability, the attacker must have valid c
Cisco
Cisco Unified Intelligence Center Arbitrary File Upload Vulnerability
vendor_cisco·CVSS 3.1
CVE-2025-20274 Cisco Unified Intelligence Center Arbitrary File Upload Vulnerability
CVE-2025-20274: Cisco Unified Intelligence Center Arbitrary File Upload Vulnerability
A vulnerability in the web-based management interface of Cisco Unified Intelligence Center could allow an authenticated, remote attacker to upload arbitrary files to an affected device. This vulnerability is due to improper validation of files that are uploaded to the web-based management interface. An attacker could exploit this vulnerability by uploading arbitrary files to an affected device. A successful exploit could allow the attacker to store malicious files on the system and execute arbitrary commands on the operating system. The Security Impact Rating (SIR) of this advisory has been raised to High because an attacker could elevate privileges to root . To exploit this vulnerability, the attacker mu
GHSA
GHSA-phq6-884q-fxgr: A vulnerability in the web-based management interface of Cisco Unified Intelligence Center could allow an authenticated, remote attacker to upload arb
ghsa_unreviewed·2025-07-16
CVE-2025-20274 [MEDIUM] CWE-434 GHSA-phq6-884q-fxgr: A vulnerability in the web-based management interface of Cisco Unified Intelligence Center could allow an authenticated, remote attacker to upload arb
A vulnerability in the web-based management interface of Cisco Unified Intelligence Center could allow an authenticated, remote attacker to upload arbitrary files to an affected device.
This vulnerability is due to improper validation of files that are uploaded to the web-based management interface. An attacker could exploit this vulnerability by uploading arbitrary files to an affected device. A successful exploit could allow the attacker to store malicious files on the system and execute arbitrary commands on the operating system. The Security Impact Rating (SIR) of this advisory has been raised to High because an attacker could elevate privileges to root. To exploit this vulnerability, the attacker must have valid credentials for a user account with at least the role of Report Designer
No detection rules found.
No public exploits indexed.
2025-07-16
Published