CVE-2025-20156: Cisco Meeting Management Client-Server Privilege Escalation Vulnerability
First published: Wed Jan 22 2025(Updated: )
A vulnerability in the REST API of Cisco Meeting Management could allow a remote, authenticated attacker with low privileges to elevate privileges to administrator on an affected device. This vulnerability exists because proper authorization is not enforced upon REST API users. An attacker could exploit this vulnerability by sending API requests to a specific endpoint. A successful exploit could allow the attacker to gain administrator-level control over edge nodes that are managed by Cisco Meeting Management.
Credit: psirt@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco Meeting Management |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cmm-privesc-uy2Vf8pc
- https://blog.clamav.net/2025/01/clamav-142-and-108-security-patch.html
- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-clamav-ole2-H549rphA
- https://www.bleepingcomputer.com/news/security/cisco-warns-of-denial-of-service-flaw-with-poc-exploit-code/
- https://www.theregister.com/2025/01/23/cisco_fixes_critical_bug/
- https://www.darkreading.com/vulnerabilities-threats/cisco-critical-meeting-management-bug-urgent-patch
Frequently Asked Questions
What is the severity of CVE-2025-20156?
CVE-2025-20156 is considered a high severity vulnerability due to its potential for privilege escalation.
How do I fix CVE-2025-20156?
To fix CVE-2025-20156, apply the latest security patches provided by Cisco for the Meeting Management software.
Who is affected by CVE-2025-20156?
The vulnerability affects authenticated users with low privileges on Cisco Meeting Management devices.
What type of vulnerability is CVE-2025-20156?
CVE-2025-20156 is a privilege escalation vulnerability in the REST API of Cisco Meeting Management.
Can CVE-2025-20156 be exploited remotely?
Yes, CVE-2025-20156 can be exploited remotely by an authenticated user with low privileges.
- agent/title
- agent/type
- agent/first-publish-date
- agent/description
- agent/guess-ai
- agent/software-canonical-lookup
- agent/softwarecombine
- agent/author
- collector/bleeping-computer
- source/BleepingComputer
- alias/CVE-2025-20128
- alias/CVE-2025-20165
- alias/CVE-2025-20156
- alias/CVE-2024-20481
- alias/CVE-2024-20418
- agent/weakness
- collector/the-register
- source/The Register
- agent/news-ai
- agent/severity
- collector/darkreading
- source/Dark Reading
- agent/source
- agent/references
- agent/tags
- agent/event
- agent/trending
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- collector/nvd-api
- source/NVD
- vendor/cisco
- canonical/cisco meeting management