High severity · published Feb 21, 2024
CVE-2024-20325
A vulnerability in the Live Data server of Cisco Unified Intelligence Center could allow an unauthenticated, local attacker to read and modify data in a repository that belongs to…
7.1
CVSS
0.1%
EPSS
No
On KEV
Description
A vulnerability in the Live Data server of Cisco Unified Intelligence Center could allow an unauthenticated, local attacker to read and modify data in a repository that belongs to an internal service on an affected device.
This vulnerability is due to insufficient access control implementations on cluster configuration CLI requests. An attacker could exploit this vulnerability by sending a cluster configuration CLI request to specific directories on an affected device. A successful exploit could allow the attacker to read and modify data that is handled by an internal service on the affected device.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 4% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CU
Cisco Unified Intelligence Center · Cisco
11.0(1); 11.0(2); 11.0(3); 10.5(1); 11.5(1); 11.6(1); +4 more · source: vendor
UI
Unified Intelligence Center · Cisco
before 12.5(1)_es03; 12.6(1) before 12.6(1)_es08; 12.6(2) before 12.6(2)ES02 · source: NVD, CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-20325
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-20325
Vendor Advisory
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cuic-access-control-jJsZQMjj
More from Cisco Unified Intelligence Center
8.8
CVE-2025-20274
Cisco Unified Intelligence Center Arbitrary File Upload Vulnerability
7.4
CVE-2019-1658
Cisco Unified Intelligence Center Cross-Site Request Forgery Vulnerability
7.1
CVE-2025-20113
Cisco Unified Intelligence Center Privilege Escalation Vulnerability
6.7
CVE-2025-20278
Cisco Unified Communications Products Command Injection Vulnerability
6.5
CVE-2026-20327
Cisco Unified Intelligence Center SQL Injection Vulnerability
