CVE-2025-20236
Last modified
CVE-2025-20236 is a high-severity vulnerability rated 8.8/10 on the CVSS scale. A vulnerability in the custom URL parser of Cisco Webex App could allow an unauthenticated, remote attacker to persuade a user to download arbitrary files, which could allow the attacker to execute arbitrary commands on the host of the targeted user. This vulnerability is due to insufficient input validation when Cisco Webex App processes a meeting invite link. An attacker could exploit this vulnerability by persuading a user to click a crafted meeting invite link and download arbitrary files. EPSS estimates a 0.91% chance of exploitation in the next 30 days.
Description
A vulnerability in the custom URL parser of Cisco Webex App could allow an unauthenticated, remote attacker to persuade a user to download arbitrary files, which could allow the attacker to execute arbitrary commands on the host of the targeted user. This vulnerability is due to insufficient input validation when Cisco Webex App processes a meeting invite link. An attacker could exploit this vulnerability by persuading a user to click a crafted meeting invite link and download arbitrary files. A successful exploit could allow the attacker to execute arbitrary commands with the privileges of the targeted user.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Cisco | Webex Teams | 44.6 |
| Cisco | Webex Teams | 44.6.0.29928 |
| Cisco | Webex Teams | 44.6.0.30148 |
| Cisco | Webex Teams | 44.7 |
| Cisco | Webex Teams | 44.7.0.30141 |
| Cisco | Webex Teams | 44.7.0.30285 |
References
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2025-20236?
How severe is CVE-2025-20236?
How do I fix CVE-2025-20236?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-20230In Splunk Enterprise versions below 9.4.1, 9.3.3, 9.2.5, and…6.5
- CVE-2025-20231In Splunk Enterprise versions below 9.4.1, 9.3.3, 9.2.5, and…5.7
- CVE-2025-20232In Splunk Enterprise versions below 9.3.3, 9.2.5, and 9.1.8 …5.7
- CVE-2025-20233In the Splunk App for Lookup File Editing versions below 4.0…3.3
- CVE-2025-20234A vulnerability in Universal Disk Format (UDF) processing of…7.5
- CVE-2025-20235A vulnerability in the web-based management interface of Cis…6.1
- CVE-2025-20237A vulnerability in Cisco Secure Firewall Adaptive Security A…6
- CVE-2025-20238A vulnerability in Cisco Secure Firewall Adaptive Security A…6
- CVE-2025-20239A vulnerability in the Internet Key Exchange Version 2 (IKEv…8.6
- CVE-2025-2024Trimble SketchUp SKP File Parsing Uninitialized Variable Rem…7.8
- CVE-2025-20240A vulnerability in the Web Authentication feature of Cisco I…6.1
- CVE-2025-20241A vulnerability in the Intermediate System-to-Intermediate S…7.4
Are you affected by CVE-2025-20236?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST