Cisco Unified Intelligence Center: Authenticated Local SQL Injection Exposes Internal Database

RootPwn reports that Cisco’s Unified Intelligence Center (UIC) has a blind SQL injection vulnerability in its web‑based management console. The flaw is exploitable only by users who are already authenticated on the device, meaning an attacker needs legitimate credentials to trigger it.

Vulnerability Overview

The root cause is insufficient input validation on the management interface. A crafted request can bypass normal checks and inject SQL commands that read data from the internal database. Because the injection is blind, the attacker does not see immediate output, but can infer database contents through timing or error responses.

Impact

• Read access to the device’s internal database, potentially exposing configuration data and sensitive information.
• Requires legitimate credentials; therefore, compromise of user accounts amplifies the risk.
• No known workaround; the only mitigation is applying Cisco’s patch.

Mitigation

Cisco has released software updates that address the flaw. Network operators should apply the latest UIC patches as soon as possible. Until patches are applied, the only safe action is to restrict or disable local user accounts that are not required for day‑to‑day operations.

Reference

CVE‑2026‑20327 – Medium severity – Cisco Unified Intelligence Center SQL Injection