InfoSecBulletin Cybersecurity for mankind
Cisco has released a security advisory concerning a critical privilege escalation vulnerability (CVE-2025-20156) in its Meeting Management software. With a daunting CVSS score of 9.9, this vulnerability poses a significant risk, as it could enable remote, authenticated attackers with minimal privileges to elevate their access to administrator status on compromised devices.
Cisco warns, “A successful exploit could allow the attacker to gain administrator-level control over edge nodes that are managed by Cisco Meeting Management.”
FBI investigating cyberattack at Oracle, Bloomberg News reports
OpenAI Offering $100K Bounties for Critical Vulns
Splunk Alert User RCE and Data Leak Vulns
CIRT alert Situational Awareness for Eid Holidays
Cyberattack on Malaysian airports: PM rejected $10 million ransom
Micropatches released for Windows zero-day leaking NTLM hashes
VMware Patches Authentication Bypass Flaw in Windows Tool
IngressNightmare
Over 40% of cloud environments are vulnerable to RCE
(CVE-2025-29927)
Urgently Patch Your Next.js for Authorization Bypass
Oracle refutes breach after hacker claims 6 million data theft
This vulnerability affects all versions of Cisco Meeting Management prior to the fixed release. Exploitation of this issue could give attackers significant control over systems, potentially disrupting business operations.
The following software releases are impacted:
Versions 3.8 and earlier: Users are advised to migrate to a fixed release.
Version 3.9: Patched in version 3.9.1.
Version 3.10: Not vulnerable.
Cisco has confirmed that there are no workarounds available to mitigate this vulnerability. The only solution is to apply the necessary software updates. Users are advised to consult the advisory for detailed information on affected and fixed releases.
Cisco has provided free software updates to address the CVE-2025-20156 vulnerability. Customers with valid service contracts can access these updates via their regular update channels. Users without service contracts are advised to contact Cisco’s Technical Assistance Center (TAC) to obtain the necessary upgrades. For seamless updates, Cisco recommends verifying hardware compatibility and ensuring sufficient memory for the new software release.
Delay patching leaves about 50,000 Fortinet firewalls to zero-day attack
