Vulnerability Description
A vulnerability in the REST API of Cisco Meeting Management could allow a remote, authenticated attacker with low privileges to elevate privileges to administrator on an affected device. This vulnerability exists because proper authorization is not enforced upon REST API users. An attacker could exploit this vulnerability by sending API requests to a specific endpoint. A successful exploit could allow the attacker to gain administrator-level control over edge nodes that are managed by Cisco Meeting Management.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Cisco | Meeting Management | < 3.9.1 |
Related Weaknesses (CWE)
References
- https://blog.clamav.net/2025/01/clamav-142-and-108-security-patch.htmlNot Applicable
- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/ciNot Applicable
- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/ciVendor Advisory
FAQ
What is CVE-2025-20156?
CVE-2025-20156 is a vulnerability with a CVSS score of 9.9 (CRITICAL). A vulnerability in the REST API of Cisco Meeting Management could allow a remote, authenticated attacker with low privileges to elevate privileges to administrator on an affected device. This vulne...
How severe is CVE-2025-20156?
CVE-2025-20156 has been rated CRITICAL with a CVSS base score of 9.9/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2025-20156?
Check the references section above for vendor advisories and patch information. Affected products include: Cisco Meeting Management.