Cisco Unified Intelligence Center vulnerabilities

26 CVEs affecting Cisco Unified Intelligence Center, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-20288, published 2025-07-16.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-44228: Apache Log4j2 Remote Code Execution Vulnerability, published 2021-12-10. Critical severity, CVSS 10.0. Actively exploited: in CISA KEV since 2021-12-10. EPSS: 100% chance of exploitation in the next 30 days. Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker…
CVE-2017-12337, published 2017-11-16. Critical severity, CVSS 9.8. EPSS: 6.4% chance of exploitation in the next 30 days. A vulnerability in the upgrade mechanism of Cisco collaboration products based on the Cisco Voice Operating System software platform could allow an unauthenticated, remote attacker to gain…
CVE-2017-12254, published 2017-09-21. Medium severity, CVSS 6.1. EPSS: 2.3% chance of exploitation in the next 30 days. A vulnerability in the web interface of Cisco Unified Intelligence Center could allow an unauthenticated, remote attacker to perform a Document Object Model (DOM)-based cross-site scripting attack.…
CVE-2017-6779, published 2018-06-07. High severity, CVSS 7.5. EPSS: 2% chance of exploitation in the next 30 days. Multiple Cisco products are affected by a vulnerability in local file management for certain system log files of Cisco collaboration products that could allow an unauthenticated, remote attacker to…
CVE-2017-12248, published 2017-09-21. Medium severity, CVSS 6.1. EPSS: 1.7% chance of exploitation in the next 30 days. A vulnerability in the web framework code of Cisco Unified Intelligence Center Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user…
CVE-2016-6426, published 2016-10-05. High severity, CVSS 7.5. EPSS: 1.3% chance of exploitation in the next 30 days. The j_spring_security_switch_user function in Cisco Unified Intelligence Center (CUIC) 8.5.4 through 9.1(1), as used in Unified Contact Center Express 10.0(1) through 11.0(1), allows remote attackers…
CVE-2017-6789, published 2017-09-07. Medium severity, CVSS 6.1. EPSS: 1.3% chance of exploitation in the next 30 days. A vulnerability in the Cisco Unified Intelligence Center web interface could allow an unauthenticated, remote attacker to impact the integrity of the system by executing a Document Object Model…
CVE-2019-1860, published 2019-05-16. Medium severity, CVSS 5.9. EPSS: 1.3% chance of exploitation in the next 30 days. A vulnerability in the dashboard gadget rendering of Cisco Unified Intelligence Center could allow an unauthenticated, remote attacker to obtain or manipulate sensitive information between a…
CVE-2015-0740, published 2015-05-20. Medium severity, CVSS 6.8. EPSS: 1.3% chance of exploitation in the next 30 days. Cross-site request forgery (CSRF) vulnerability in Cisco Unified Intelligence Center 10.6(1) allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCus28826.
CVE-2019-1670, published 2019-02-07. Medium severity, CVSS 6.1. EPSS: 1.2% chance of exploitation in the next 30 days. A vulnerability in the web-based management interface of Cisco Unified Intelligence Center Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack…

Latest

CVE-2025-20288, published 2025-07-16. Medium severity, CVSS 5.3. EPSS: 0.4% chance of exploitation in the next 30 days. A vulnerability in the web-based management interface of Cisco Unified Intelligence Center could allow an unauthenticated, remote attacker to conduct a server-side request forgery (SSRF) attack…
CVE-2025-20274, published 2025-07-16. High severity, CVSS 8.8. EPSS: 0.5% chance of exploitation in the next 30 days. A vulnerability in the web-based management interface of Cisco Unified Intelligence Center could allow an authenticated, remote attacker to upload arbitrary files to an affected device. This…
CVE-2025-20278, published 2025-06-04. Medium severity, CVSS 6.7. EPSS: 0.2% chance of exploitation in the next 30 days. A vulnerability in the CLI of multiple Cisco Unified Communications products could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system of an…
CVE-2025-20114, published 2025-05-21. Medium severity, CVSS 4.3. EPSS: 0.4% chance of exploitation in the next 30 days. A vulnerability in the API of Cisco Unified Intelligence Center could allow an authenticated, remote attacker to perform a horizontal privilege escalation attack on an affected system. This…
CVE-2025-20113, published 2025-05-21. High severity, CVSS 7.1. EPSS: 0.4% chance of exploitation in the next 30 days. A vulnerability in Cisco Unified Intelligence Center could allow an authenticated, remote attacker to elevate privileges to Administrator for a limited set of functions on an affected system. This…
CVE-2024-20325, published 2024-02-21. High severity, CVSS 7.1. EPSS: 0.1% chance of exploitation in the next 30 days. A vulnerability in the Live Data server of Cisco Unified Intelligence Center could allow an unauthenticated, local attacker to read and modify data in a repository that belongs to an internal service…
CVE-2023-20062, published 2023-03-03. Medium severity, CVSS 4.3. EPSS: 0.5% chance of exploitation in the next 30 days. Multiple vulnerabilities in Cisco Unified Intelligence Center could allow an authenticated, remote attacker to collect sensitive information or perform a server-side request forgery (SSRF) attack on…
CVE-2023-20061, published 2023-03-03. Medium severity, CVSS 6.5. EPSS: 0.7% chance of exploitation in the next 30 days. Multiple vulnerabilities in Cisco Unified Intelligence Center could allow an authenticated, remote attacker to collect sensitive information or perform a server-side request forgery (SSRF) attack on…
CVE-2023-20058, published 2023-01-20. Medium severity, CVSS 6.1. EPSS: 0.5% chance of exploitation in the next 30 days. A vulnerability in the web-based management interface of Cisco Unified Intelligence Center could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting (XSS) attack…