CVE-2025-20236: Cisco Webex App Client-Side Remote Code Execution Vulnerability
First published: Wed Apr 16 2025(Updated: )
A vulnerability in the custom URL parser of Cisco Webex App could allow an unauthenticated, remote attacker to persuade a user to download arbitrary files, which could allow the attacker to execute arbitrary commands on the host of the targeted user. This vulnerability is due to insufficient input validation when Cisco Webex App processes a meeting invite link. An attacker could exploit this vulnerability by persuading a user to click a crafted meeting invite link and download arbitrary files. A successful exploit could allow the attacker to execute arbitrary commands with the privileges of the targeted user.
Credit: psirt@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Webex App Launcher |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Peer vulnerabilities
(Found alongside the following vulnerabilities)
Frequently Asked Questions
What is the severity of CVE-2025-20236?
CVE-2025-20236 is considered a high-severity vulnerability due to its potential for remote code execution.
How do I fix CVE-2025-20236?
To remediate CVE-2025-20236, update the Cisco Webex App to the latest version released by Cisco.
What types of attacks can CVE-2025-20236 enable?
CVE-2025-20236 can enable attackers to persuade users into downloading arbitrary files, potentially leading to remote code execution.
Who is affected by CVE-2025-20236?
Any user of the Cisco Webex App could be affected by CVE-2025-20236 if they interact with malicious links.
Can CVE-2025-20236 be exploited without user interaction?
CVE-2025-20236 requires user interaction, as the user must be persuaded to download the malicious file.
- agent/weakness
- agent/type
- agent/first-publish-date
- agent/author
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- collector/bleeping-computer
- source/BleepingComputer
- alias/CVE-2025-20236
- alias/CVE-2025-20178
- alias/CVE-2025-20150
- alias/CVE-2024-20439
- agent/news-ai
- agent/source
- agent/references
- agent/severity
- agent/event
- agent/trending
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/description
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- vendor/cisco
- canonical/webex app launcher