Cisco UIC Web UI Arbitrary File Upload (CVE-2025-20274)
CVE-2025-20274 Published on July 16, 2025

Cisco Unified Intelligence Center Arbitrary File Upload Vulnerability
A vulnerability in the web-based management interface of Cisco Unified Intelligence Center could allow an authenticated, remote attacker to upload arbitrary files to an affected device. This vulnerability is due to improper validation of files that are uploaded to the web-based management interface. An attacker could exploit this vulnerability by uploading arbitrary files to an affected device. A successful exploit could allow the attacker to store malicious files on the system and execute arbitrary commands on the operating system. The Security Impact Rating (SIR) of this advisory has been raised to High because an attacker could elevate privileges to root. To exploit this vulnerability, the attacker must have valid credentials for a user account with at least the role of Report Designer.

NVD

Vulnerability Analysis

CVE-2025-20274 is exploitable with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to be low. considered to have a small impact on confidentiality and integrity and availability.

Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
LOW
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
LOW
Integrity Impact:
LOW
Availability Impact:
LOW

Weakness Type

What is an Unrestricted File Upload Vulnerability?

The software allows the attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment.

CVE-2025-20274 has been classified to as an Unrestricted File Upload vulnerability or weakness.


Products Associated with CVE-2025-20274

stack.watch emails you whenever new vulnerabilities are published in Cisco Unified Intelligence Center or Cisco Unified Contact Center Express. Just hit a watch button to start following.

Cisco Unified Intelligence Center
 
Cisco Unified Contact Center Express
 

Affected Versions

Cisco Unified Contact Center Express: Cisco Unified Intelligence Center:

Exploit Probability

EPSS
0.27%
Percentile
49.90%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.