CVE-2025-20274 [Medium] | File Upload / RCE in Unified Intelligence Center

A vulnerability in the web-based management interface of Cisco Unified Intelligence Center could allow an authenticated, remote attacker to upload arbitrary files to an affected device. This vulnerability is due to improper validation of files that are uploaded to the web-based management interface. An attacker could exploit this vulnerability by uploading arbitrary files to an affected device. A successful exploit could allow the attacker to store malicious files on the system and execute arbitrary commands on the operating system. The Security Impact Rating (SIR) of this advisory has been raised to High because an attacker could elevate privileges to root. To exploit this vulnerability, the attacker must have valid credentials for a user account with at least the role of Report Designer.

#	Date	Old EPSS score	New EPSS score	Delta (New - Old)
1	2026-05-12	0.36%	0.96%	+0.60%
2	2026-04-01	0.28%	0.36%	+0.08%
3	2026-02-09	—	0.28%	—

Date

Old EPSS score

New EPSS score

Delta (New - Old)

2026-05-12

0.36%

0.96%

+0.60%

2026-04-01

0.28%

0.36%

+0.08%

2026-02-09

—

0.28%

—

Base score	Version	Severity	Vector	Exploitability	Impact	Score source
6.3	3.1	MEDIUM	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L` Click to expand Attack vector (AV:N) Could be attacked over the internet or any normal routed network—not just someone sitting at the machine. Attack complexity (AC:L) Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup. Privileges required (PR:L) A normal user session is enough; they don’t have to be admin. User interaction (UI:N) Nobody has to click “OK” or open a trap file; it can work without a victim helping. Scope (S:U) Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems. Confidentiality (C:L) Some sensitive info could get out, but not a total data dump. Integrity (I:L) Attackers could change some data, but it’s limited—not everything goes. Availability (A:L) Might cause slowdowns, glitches, or partial disruption—not a full brick.	2.8	3.4	[email protected]
8.8	3.1	HIGH	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H` Click to expand Attack vector (AV:N) Could be attacked over the internet or any normal routed network—not just someone sitting at the machine. Attack complexity (AC:L) Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup. Privileges required (PR:L) A normal user session is enough; they don’t have to be admin. User interaction (UI:N) Nobody has to click “OK” or open a trap file; it can work without a victim helping. Scope (S:U) Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems. Confidentiality (C:H) Serious risk that confidential data gets exposed in a big way. Integrity (I:H) They could widely tamper with or forge data—trust in the data is badly hurt. Availability (A:H) Could take the service down hard or make it unusable for people who depend on it.	2.8	5.9	[email protected]

Base score

Version

Severity

Vector

Exploitability

Impact

Score source

6.3

3.1

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L Click to expand

Attack vector (AV:N): Could be attacked over the internet or any normal routed network—not just someone sitting at the machine.
Attack complexity (AC:L): Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup.
Privileges required (PR:L): A normal user session is enough; they don’t have to be admin.
User interaction (UI:N): Nobody has to click “OK” or open a trap file; it can work without a victim helping.
Scope (S:U): Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems.
Confidentiality (C:L): Some sensitive info could get out, but not a total data dump.
Integrity (I:L): Attackers could change some data, but it’s limited—not everything goes.
Availability (A:L): Might cause slowdowns, glitches, or partial disruption—not a full brick.

2.8

3.4

[email protected]

8.8

3.1

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Click to expand

Attack vector (AV:N): Could be attacked over the internet or any normal routed network—not just someone sitting at the machine.
Attack complexity (AC:L): Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup.
Privileges required (PR:L): A normal user session is enough; they don’t have to be admin.
User interaction (UI:N): Nobody has to click “OK” or open a trap file; it can work without a victim helping.
Scope (S:U): Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems.
Confidentiality (C:H): Serious risk that confidential data gets exposed in a big way.
Integrity (I:H): They could widely tamper with or forge data—trust in the data is badly hurt.
Availability (A:H): Could take the service down hard or make it unusable for people who depend on it.

2.8

5.9

[email protected]

Affected software / configurations for CVE-2025-20274

References for CVE-2025-20274

URL	Tags
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cuis-file-upload-UhNEtStm	Vendor Advisory

URL

CVE-2025-20274 | Cisco Unified Intelligence Center Arbitrary File Upload Vulnerability

Exploit prediction scoring system (EPSS) score for CVE-2025-20274

Common vulnerability scoring system (CVSS) metrics for CVE-2025-20274

Weakness enumeration for CVE-2025-20274

Affected software / configurations for CVE-2025-20274

References for CVE-2025-20274

Vendor	Product	Version	Raw CPE
cisco	unified_intelligence_center	10.5\(1\)	cpe:2.3:a:cisco:unified_intelligence_center:10.5\(1\):::::::*
cisco	unified_intelligence_center	11.0\(1\)	cpe:2.3:a:cisco:unified_intelligence_center:11.0\(1\):::::::*
cisco	unified_intelligence_center	11.0\(2\)	cpe:2.3:a:cisco:unified_intelligence_center:11.0\(2\):::::::*
cisco	unified_intelligence_center	11.0\(3\)	cpe:2.3:a:cisco:unified_intelligence_center:11.0\(3\):::::::*
cisco	unified_intelligence_center	11.5\(1\)	cpe:2.3:a:cisco:unified_intelligence_center:11.5\(1\):::::::*
cisco	unified_intelligence_center	11.6\(1\)	cpe:2.3:a:cisco:unified_intelligence_center:11.6\(1\):::::::*
cisco	unified_intelligence_center	12.0\(1\)	cpe:2.3:a:cisco:unified_intelligence_center:12.0\(1\):::::::*
cisco	unified_intelligence_center	12.5\(1\)	cpe:2.3:a:cisco:unified_intelligence_center:12.5\(1\):::::::*
cisco	unified_intelligence_center	12.5\(1\)su	cpe:2.3:a:cisco:unified_intelligence_center:12.5\(1\)su:::::::*
cisco	unified_intelligence_center	12.6\(1\)	cpe:2.3:a:cisco:unified_intelligence_center:12.6\(1\):::::::*
cisco	unified_intelligence_center	12.6\(1\)_es05_et	cpe:2.3:a:cisco:unified_intelligence_center:12.6\(1\)_es05_et:::::::*
cisco	unified_intelligence_center	12.6\(1\)_et	cpe:2.3:a:cisco:unified_intelligence_center:12.6\(1\)_et:::::::*
cisco	unified_intelligence_center	12.6\(2\)	cpe:2.3:a:cisco:unified_intelligence_center:12.6\(2\):::::::*
cisco	unified_contact_center_express	10.5\(1\)	cpe:2.3:a:cisco:unified_contact_center_express:10.5\(1\):::::::*
cisco	unified_contact_center_express	10.5\(1\)su1	cpe:2.3:a:cisco:unified_contact_center_express:10.5\(1\)su1:::::::*
cisco	unified_contact_center_express	10.5\(1\)su1es10	cpe:2.3:a:cisco:unified_contact_center_express:10.5\(1\)su1es10:::::::*
cisco	unified_contact_center_express	10.6\(1\)	cpe:2.3:a:cisco:unified_contact_center_express:10.6\(1\):::::::*
cisco	unified_contact_center_express	10.6\(1\)su1	cpe:2.3:a:cisco:unified_contact_center_express:10.6\(1\)su1:::::::*
cisco	unified_contact_center_express	10.6\(1\)su2	cpe:2.3:a:cisco:unified_contact_center_express:10.6\(1\)su2:::::::*
cisco	unified_contact_center_express	10.6\(1\)su2es04	cpe:2.3:a:cisco:unified_contact_center_express:10.6\(1\)su2es04:::::::*
cisco	unified_contact_center_express	10.6\(1\)su3	cpe:2.3:a:cisco:unified_contact_center_express:10.6\(1\)su3:::::::*
cisco	unified_contact_center_express	10.6\(1\)su3es01	cpe:2.3:a:cisco:unified_contact_center_express:10.6\(1\)su3es01:::::::*
cisco	unified_contact_center_express	10.6\(1\)su3es02	cpe:2.3:a:cisco:unified_contact_center_express:10.6\(1\)su3es02:::::::*
cisco	unified_contact_center_express	10.6\(1\)su3es03	cpe:2.3:a:cisco:unified_contact_center_express:10.6\(1\)su3es03:::::::*
cisco	unified_contact_center_express	11.0\(1\)su1	cpe:2.3:a:cisco:unified_contact_center_express:11.0\(1\)su1:::::::*
cisco	unified_contact_center_express	11.0\(1\)su1es02	cpe:2.3:a:cisco:unified_contact_center_express:11.0\(1\)su1es02:::::::*
cisco	unified_contact_center_express	11.0\(1\)su1es03	cpe:2.3:a:cisco:unified_contact_center_express:11.0\(1\)su1es03:::::::*
cisco	unified_contact_center_express	11.5\(1\)es01	cpe:2.3:a:cisco:unified_contact_center_express:11.5\(1\)es01:::::::*
cisco	unified_contact_center_express	11.5\(1\)su1	cpe:2.3:a:cisco:unified_contact_center_express:11.5\(1\)su1:::::::*
cisco	unified_contact_center_express	11.5\(1\)su1es01	cpe:2.3:a:cisco:unified_contact_center_express:11.5\(1\)su1es01:::::::*
cisco	unified_contact_center_express	11.5\(1\)su1es02	cpe:2.3:a:cisco:unified_contact_center_express:11.5\(1\)su1es02:::::::*
cisco	unified_contact_center_express	11.5\(1\)su1es03	cpe:2.3:a:cisco:unified_contact_center_express:11.5\(1\)su1es03:::::::*
cisco	unified_contact_center_express	11.6\(1\)	cpe:2.3:a:cisco:unified_contact_center_express:11.6\(1\):::::::*
cisco	unified_contact_center_express	11.6\(1\)es01	cpe:2.3:a:cisco:unified_contact_center_express:11.6\(1\)es01:::::::*
cisco	unified_contact_center_express	11.6\(1\)es02	cpe:2.3:a:cisco:unified_contact_center_express:11.6\(1\)es02:::::::*
cisco	unified_contact_center_express	11.6\(2\)	cpe:2.3:a:cisco:unified_contact_center_express:11.6\(2\):::::::*
cisco	unified_contact_center_express	11.6\(2\)es01	cpe:2.3:a:cisco:unified_contact_center_express:11.6\(2\)es01:::::::*
cisco	unified_contact_center_express	11.6\(2\)es02	cpe:2.3:a:cisco:unified_contact_center_express:11.6\(2\)es02:::::::*
cisco	unified_contact_center_express	11.6\(2\)es03	cpe:2.3:a:cisco:unified_contact_center_express:11.6\(2\)es03:::::::*
cisco	unified_contact_center_express	11.6\(2\)es04	cpe:2.3:a:cisco:unified_contact_center_express:11.6\(2\)es04:::::::*
cisco	unified_contact_center_express	11.6\(2\)es05	cpe:2.3:a:cisco:unified_contact_center_express:11.6\(2\)es05:::::::*
cisco	unified_contact_center_express	11.6\(2\)es06	cpe:2.3:a:cisco:unified_contact_center_express:11.6\(2\)es06:::::::*
cisco	unified_contact_center_express	11.6\(2\)es07	cpe:2.3:a:cisco:unified_contact_center_express:11.6\(2\)es07:::::::*
cisco	unified_contact_center_express	11.6\(2\)es08	cpe:2.3:a:cisco:unified_contact_center_express:11.6\(2\)es08:::::::*
cisco	unified_contact_center_express	12.0\(1\)	cpe:2.3:a:cisco:unified_contact_center_express:12.0\(1\):::::::*
cisco	unified_contact_center_express	12.0\(1\)es01	cpe:2.3:a:cisco:unified_contact_center_express:12.0\(1\)es01:::::::*
cisco	unified_contact_center_express	12.0\(1\)es02	cpe:2.3:a:cisco:unified_contact_center_express:12.0\(1\)es02:::::::*
cisco	unified_contact_center_express	12.0\(1\)es03	cpe:2.3:a:cisco:unified_contact_center_express:12.0\(1\)es03:::::::*
cisco	unified_contact_center_express	12.0\(1\)es04	cpe:2.3:a:cisco:unified_contact_center_express:12.0\(1\)es04:::::::*
cisco	unified_contact_center_express	12.5\(1\)	cpe:2.3:a:cisco:unified_contact_center_express:12.5\(1\):::::::*
cisco	unified_contact_center_express	12.5\(1\)_su01_es01	cpe:2.3:a:cisco:unified_contact_center_express:12.5\(1\)_su01_es01:::::::*
cisco	unified_contact_center_express	12.5\(1\)_su01_es02	cpe:2.3:a:cisco:unified_contact_center_express:12.5\(1\)_su01_es02:::::::*
cisco	unified_contact_center_express	12.5\(1\)_su01_es03	cpe:2.3:a:cisco:unified_contact_center_express:12.5\(1\)_su01_es03:::::::*
cisco	unified_contact_center_express	12.5\(1\)_su02_es01	cpe:2.3:a:cisco:unified_contact_center_express:12.5\(1\)_su02_es01:::::::*
cisco	unified_contact_center_express	12.5\(1\)_su02_es02	cpe:2.3:a:cisco:unified_contact_center_express:12.5\(1\)_su02_es02:::::::*
cisco	unified_contact_center_express	12.5\(1\)_su02_es03	cpe:2.3:a:cisco:unified_contact_center_express:12.5\(1\)_su02_es03:::::::*
cisco	unified_contact_center_express	12.5\(1\)_su02_es04	cpe:2.3:a:cisco:unified_contact_center_express:12.5\(1\)_su02_es04:::::::*
cisco	unified_contact_center_express	12.5\(1\)_su03_es01	cpe:2.3:a:cisco:unified_contact_center_express:12.5\(1\)_su03_es01:::::::*
cisco	unified_contact_center_express	12.5\(1\)_su03_es02	cpe:2.3:a:cisco:unified_contact_center_express:12.5\(1\)_su03_es02:::::::*
cisco	unified_contact_center_express	12.5\(1\)_su03_es03	cpe:2.3:a:cisco:unified_contact_center_express:12.5\(1\)_su03_es03:::::::*
cisco	unified_contact_center_express	12.5\(1\)_su03_es04	cpe:2.3:a:cisco:unified_contact_center_express:12.5\(1\)_su03_es04:::::::*
cisco	unified_contact_center_express	12.5\(1\)_su03_es05	cpe:2.3:a:cisco:unified_contact_center_express:12.5\(1\)_su03_es05:::::::*
cisco	unified_contact_center_express	12.5\(1\)_su03_es06	cpe:2.3:a:cisco:unified_contact_center_express:12.5\(1\)_su03_es06:::::::*
cisco	unified_contact_center_express	12.5\(1\)es01	cpe:2.3:a:cisco:unified_contact_center_express:12.5\(1\)es01:::::::*
cisco	unified_contact_center_express	12.5\(1\)es02	cpe:2.3:a:cisco:unified_contact_center_express:12.5\(1\)es02:::::::*
cisco	unified_contact_center_express	12.5\(1\)es03	cpe:2.3:a:cisco:unified_contact_center_express:12.5\(1\)es03:::::::*
cisco	unified_contact_center_express	12.5\(1\)su1	cpe:2.3:a:cisco:unified_contact_center_express:12.5\(1\)su1:::::::*
cisco	unified_contact_center_express	12.5\(1\)su2	cpe:2.3:a:cisco:unified_contact_center_express:12.5\(1\)su2:::::::*
cisco	unified_contact_center_express	12.5\(1\)su3	cpe:2.3:a:cisco:unified_contact_center_express:12.5\(1\)su3:::::::*