CVE-2025-20236: Cisco Webex App Client-Side Remote Code Execution Vulnerability
A vulnerability in the custom URL parser of Cisco Webex App could allow an unauthenticated, remote attacker to persuade a user to download arbitrary files, which could allow the attacker to execute arbitrary commands on the host of the targeted user. This vulnerability is due to insufficient input validation when Cisco Webex App processes a meeting invite link. An attacker could exploit this vulnerability by persuading a user to click a crafted meeting invite link and download arbitrary files. A successful exploit could allow the attacker to execute arbitrary commands with the privileges of the targeted user.
Affected Software
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2025-20236?
CVE-2025-20236 is considered a high-severity vulnerability due to its potential for remote code execution.
How do I fix CVE-2025-20236?
To remediate CVE-2025-20236, update the Cisco Webex App to the latest version released by Cisco.
What types of attacks can CVE-2025-20236 enable?
CVE-2025-20236 can enable attackers to persuade users into downloading arbitrary files, potentially leading to remote code execution.
Who is affected by CVE-2025-20236?
Any user of the Cisco Webex App could be affected by CVE-2025-20236 if they interact with malicious links.
Can CVE-2025-20236 be exploited without user interaction?
CVE-2025-20236 requires user interaction, as the user must be persuaded to download the malicious file.