
Cisco has issued a security advisory addressing a critical privilege escalation vulnerability (CVE-2025-20156) in its Meeting Management software. With a CVSS score of 9.9, this flaw could allow remote, authenticated attackers with low-level privileges to escalate their access to administrator level on affected devices.
The vulnerability exists due to insufficient authorization checks within the REST API of Cisco Meeting Management. Attackers can exploit this flaw by sending specifically crafted API requests to targeted endpoints. Cisco warns, “A successful exploit could allow the attacker to gain administrator-level control over edge nodes that are managed by Cisco Meeting Management.”
This vulnerability affects all versions of Cisco Meeting Management prior to the fixed release. Exploitation of this issue could give attackers significant control over systems, potentially disrupting business operations.
The following software releases are impacted:
- Versions 3.8 and earlier: Users are advised to migrate to a fixed release.
- Version 3.9: Patched in version 3.9.1.
- Version 3.10: Not vulnerable.
Cisco has confirmed that there are no workarounds available to mitigate this vulnerability. The only solution is to apply the necessary software updates. Users are advised to consult the advisory for detailed information on affected and fixed releases.
Cisco has provided free software updates to address the CVE-2025-20156 vulnerability. Customers with valid service contracts can access these updates via their regular update channels. Users without service contracts are advised to contact Cisco’s Technical Assistance Center (TAC) to obtain the necessary upgrades. For seamless updates, Cisco recommends verifying hardware compatibility and ensuring sufficient memory for the new software release.
Related Posts:
- Mercedes-Benz MBUX Vulnerabilities: User Data and Safety at Risk
- Proof-of-Concept Found for ClamAV DoS Flaw: CVE-2025-20128
- GamaCopy: A New Cyber Espionage Group Imitating Gamaredon to Target Russia