6.5
CVE-2026-20327
- EPSS 0.21%
- Veröffentlicht 19.08.2026 16:22:04
- Zuletzt bearbeitet 20.08.2026 13:01:19
- Erkennungen
Cisco Unified Intelligence Center SQL Injection Vulnerability
A vulnerability in the web-based management interface of Cisco Unified Intelligence Center could allow an authenticated, local attacker to perform a blind SQL injection attack against an affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted request to the web-based management interface. A successful exploit could allow the attacker to read the contents of the internal database of an affected device. To exploit this vulnerability, the attacker must have valid user credentials on the affected device.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerCisco
≫
Produkt
Cisco Unified Intelligence Center
Default Statusunknown
Version
11.6(1)
Status
affected
Version
10.5(1)
Status
affected
Version
11.0(1)
Status
affected
Version
11.5(1)
Status
affected
Version
12.0(1)
Status
affected
Version
12.5(1)
Status
affected
Version
11.0(2)
Status
affected
Version
12.6(1)
Status
affected
Version
12.5(1)SU
Status
affected
Version
12.6(1)_ET
Status
affected
Version
12.6(1)_ES05_ET
Status
affected
Version
11.0(3)
Status
affected
Version
12.6(2)
Status
affected
Version
12.6(2)_504_Issue_ET
Status
affected
Version
12.6.1_ExcelIssue_ET
Status
affected
Version
12.6(2)_Permalink_ET
Status
affected
Version
12.6.2_CSCwk19536_ET
Status
affected
Version
12.6.2_CSCwm96922_ET
Status
affected
Version
12.6.2_Amq_OOS_ET
Status
affected
Version
12.5(2)ET_CSCwi79933
Status
affected
Version
12.6(2)_ET
Status
affected
Version
12.6.2_CSCwn48501_ET
Status
affected
Version
15.0(1)
Status
affected
Version
12.6.2_CSCwp61293_ET
Status
affected
Version
15.0.1_CSCwn17585_ET
Status
affected
Version
15.0(1)ES202508
Status
affected
Version
12.6.2_CSCwp92614_ET
Status
affected
Version
15.0(1)ES202511
Status
affected
Version
12.6(2)ES6
Status
affected
Version
15.0(1)ES202602
Status
affected
Version
12.6(2)ES7
Status
affected
Version
15.0(1)SU1
Status
affected
Version
15.0.1_CSCwu05225_ET
Status
affected
Version
15.0.1_CSCwu53931_ET
Status
affected
Version
15.0.1_CSCwu75294_ET
Status
affected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. 
Login
Login| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.21% | 0.108 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| Cisco PSIRT | 6.5 | 2.8 | 3.6 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
|
CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cuic-sql-inject-2qbfWSm5