CVE-2020-3537: A vulnerability in Cisco Jabber for Windows software could allow an authenticated, remote attacker to gain access to sensitive information. The vulner...

Description

A vulnerability in Cisco Jabber for Windows software could allow an authenticated, remote attacker to gain access to sensitive information. The vulnerability is due to improper validation of message contents. An attacker could exploit this vulnerability by sending specially crafted messages that contain Universal Naming Convention (UNC) links to a targeted user and convincing the user to follow the provided link. A successful exploit could allow the attacker to cause the application to access a remote system, possibly allowing the attacker to gain access to sensitive information that the attacker could use in additional attacks.

Metrics

CVSS 3.1

5.7/10

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

EPSS Probability

1.27%

66.0th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

Vendor	Product	Versions
Cisco	Jabber	>= 12.1, < 12.1.3
Cisco	Jabber	>= 12.5, < 12.5.2
Cisco	Jabber	>= 12.6, < 12.6.3
Cisco	Jabber	>= 12.7, < 12.7.2
Cisco	Jabber	>= 12.8, < 12.8.3
Cisco	Jabber	>= 12.9, < 12.9.1

References

Timeline

Published: Sep 4, 2020
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2020-3537?

A vulnerability in Cisco Jabber for Windows software could allow an authenticated, remote attacker to gain access to sensitive information. The vulnerability is due to improper validation of message contents. An attacker could exploit this vulnerability by sending specially crafted messages that contain Universal Naming Convention (UNC) links to a targeted user and convincing the user to follow the provided link. A successful exploit could allow the attacker to cause the application to access a remote system, possibly allowing the attacker to gain access to sensitive information that the attacker could use in additional attacks.

How severe is CVE-2020-3537?

CVE-2020-3537 has a CVSS score of 5.7/10 (MEDIUM severity). The EPSS model estimates a 1.27% probability of exploitation in the next 30 days.

How do I fix CVE-2020-3537?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.