A critical security vulnerability has been discovered in Cisco’s Unified Intelligence Center that allows authenticated remote attackers to upload arbitrary files to affected systems, potentially enabling complete system compromise.
The flaw, tracked as CVE-2025-20274, carries a CVSS score of 6.3 and has been assigned a High security impact rating by Cisco due to the potential for privilege escalation to root access.
The vulnerability stems from improper validation of files uploaded through the web-based management interface of Cisco Unified Intelligence Center.
According to Cisco’s security advisory published on July 16, 2025, attackers with valid credentials for a user account possessing at least Report Designer role privileges can exploit this weakness to upload malicious files to the target system.
| CVE Details | Information |
| CVE ID | CVE-2025-20274 |
| CVSS Score | 6.3 (High) |
| CWE | CWE-434 |
| Advisory ID | cisco-sa-cuis-file-upload-UhNEtStm |
| Bug IDs | CSCwn18794, CSCwn26636 |
| First Published | July 16, 2025 |
The attack sequence involves an authenticated user uploading specially crafted files through the management interface, which then allows for the execution of arbitrary commands on the underlying operating system.
This represents a significant escalation path, as successful exploitation could grant attackers root-level access to the compromised system, effectively providing complete control over the infrastructure.
Affected Products and Solutions
The vulnerability impacts multiple Cisco enterprise communication solutions, including Cisco Unified Intelligence Center deployments used in Packaged Contact Center Enterprise (Packaged CCE) and Unified Contact Center Enterprise (Unified CCE) environments.
Additionally, Cisco Unified Contact Center Express (Unified CCX) is affected since it bundles the vulnerable Intelligence Center component.
Specific vulnerable versions include Cisco Unified Intelligence Center releases 12.5 and 12.6, along with Cisco Unified CCX version 12.5(1)SU3 and earlier releases. However, version 15 of both products has been confirmed as not vulnerable to this particular flaw.
Cisco has released patches to address the vulnerability, with no workarounds available for affected systems.
For Cisco Unified Intelligence Center, the fixed releases are 12.5(1) SU ES05 for the 12.5 branch and 12.6(2) ES05 for the 12.6 branch. Organizations running Cisco Unified CCX version 12.5(1)SU3 or earlier must migrate to a fixed release, while version 15 users are already protected.
The vulnerability was responsibly disclosed by security researchers Khaled Emad and Abdelrahman Osama from CyShield.
Cisco’s Product Security Incident Response Team (PSIRT) has stated that they are not aware of any public exploitation or malicious use of this vulnerability.
Organizations using affected Cisco Unified Intelligence Center deployments should prioritize applying the available security updates to prevent potential system compromise.
The combination of authenticated access requirements and the potential for root privilege escalation makes this vulnerability particularly concerning for enterprise environments where these systems manage critical communication infrastructure.
Get Free Ultimate SOC Requirements Checklist Before you build, buy, or switch your SOC for 2025 - Download Now
Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise…
Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds…
Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to…
A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a…
GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises…
Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with…