CVE-2024-20325

HighCVSS 7.1/10Last modified Jun 17, 2026

Description

A vulnerability in the Live Data server of Cisco Unified Intelligence Center could allow an unauthenticated, local attacker to read and modify data in a repository that belongs to an internal service on an affected device. This vulnerability is due to insufficient access control implementations on cluster configuration CLI requests. An attacker could exploit this vulnerability by sending a cluster configuration CLI request to specific directories on an affected device. A successful exploit could allow the attacker to read and modify data that is handled by an internal service on the affected device.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-284

Affected software

VendorProductVersions
CiscoCisco Unified Intelligence Center11.0(1); 11.0(2); 11.0(3); 10.5(1); 11.5(1); 11.6(1); 12.0(1); 12.5(1); 12.5(1)SU; 12.6(1)
ciscounified_intelligence_center11.0\(1\); 11.0\(2\); 11.0\(3\); 10.5\(1\); 11.5\(1\); 11.6\(1\); 12.0\(1\); 12.5\(1\); 12.5\(1\)su; 12.6\(1\)

References

Timeline

Published
Feb 21, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-203267.8A vulnerability in the ConfD CLI and the Cisco Crosswork Network Services Orchestrator CLI could allow an authenticated, low-privileged, loCVE-2024-203277.4A vulnerability in the PPP over Ethernet (PPPoE) termination feature of Cisco IOS XR Software for Cisco ASR 9000 Series Aggregation ServicesCVE-2024-203285.3A vulnerability in the VirusEvent feature of ClamAV could allow a local attacker to inject arbitrary commands with the privileges of the appCVE-2024-203299.9A vulnerability in the SSH subsystem of Cisco Adaptive Security Appliance (ASA) Software could allow an authenticated, remote attacker to exCVE-2024-20334.3The Video Conferencing with Zoom plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, CVE-2024-203307.5A vulnerability in the Snort 2 and Snort 3 TCP and UDP detection engine of Cisco Firepower Threat Defense (FTD) Software for Cisco FirepowerCVE-2024-203315.9A vulnerability in the session authentication functionality of the Remote Access SSL VPN feature of Cisco Adaptive Security Appliance (ASA) CVE-2024-203325.5A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker CVE-2024-203334.3A vulnerability in the web-based management interface of Cisco Catalyst Center, formerly Cisco DNA Center, could allow an authenticated, remCVE-2024-203345.4A vulnerability in the web-based management interface of Cisco TelePresence Management Suite (TMS) could allow a low-privileged, remote attaCVE-2024-203356.5A vulnerability in the web-based management interface of Cisco Small Business 100, 300, and 500 Series Wireless APs could allow an authenticCVE-2024-203366.5A vulnerability in the web-based user interface of Cisco Small Business 100, 300, and 500 Series Wireless APs could allow an authenticated,
CVE-2024-20325: High severity, CVSS 7.1 | Vulnix