CVE-2024-20325

A vulnerability in the Live Data server of Cisco Unified Intelligence Center could allow an unauthenticated, local attacker to read and modify data in a repository that belongs to an internal service on an affected device. This vulnerability is due to insufficient access control implementations on cluster configuration CLI requests. An attacker could exploit this vulnerability by sending a cluster configuration CLI request to specific directories on an affected device. A successful exploit could allow the attacker to read and modify data that is handled by an internal service on the affected device.

• CWE-284

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cuic-access-control-jJsZQMjjVendor Advisory
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cuic-access-control-jJsZQMjjVendor Advisory

Published

Feb 21, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-2032A race condition vulnerability exists in zenml-io/zenml vers…3.1
• CVE-2024-20320A vulnerability in the SSH client feature of Cisco IOS XR So…7.8
• CVE-2024-20321A vulnerability in the External Border Gateway Protocol (eBG…8.6
• CVE-2024-20322A vulnerability in the access control list (ACL) processing …5.8
• CVE-2024-20323A vulnerability in Cisco Intelligent Node (iNode) Software c…7.5
• CVE-2024-20324A vulnerability in the CLI of Cisco IOS XE Software could al…5.5
• CVE-2024-20326A vulnerability in the ConfD CLI and the Cisco Crosswork Ne…7.8
• CVE-2024-20327A vulnerability in the PPP over Ethernet (PPPoE) termination…7.4
• CVE-2024-20328A vulnerability in the VirusEvent feature of ClamAV could al…5.3
• CVE-2024-20329A vulnerability in the SSH subsystem of Cisco Adaptive Secur…9.9
• CVE-2024-2033The Video Conferencing with Zoom plugin for WordPress is vul…4.3
• CVE-2024-20330A vulnerability in the Snort 2 and Snort 3 TCP and UDP detec…7.5