InfoSecBulletin Cybersecurity for mankind
Cisco has released a security advisory concerning a critical privilege escalation vulnerability (CVE-2025-20156) in its Meeting Management software. With a daunting CVSS score of 9.9, this vulnerability poses a significant risk, as it could enable remote, authenticated attackers with minimal privileges to elevate their access to administrator status on compromised devices.
Cisco warns, “A successful exploit could allow the attacker to gain administrator-level control over edge nodes that are managed by Cisco Meeting Management.”
Account Credentials for Security Vendors Found on Dark Web: Cyble Report
Four Critical Ivanti CSA Vulnerabilities Exploited: CISA , FBI warns
GitLab Releases Patch (CVE-2025-0314) for XSS Exploit
CVE-2025-20156
Cisco Fixes Meeting Management Allowing Privilege Escalation
Delay patching leaves about 50,000 Fortinet firewalls to zero-day attack
Daily Security Update Dated: 21.01.2025
126 Linux kernel Vulns Allow Attackers Exploit 78 Linux Sub-Systems
CERT-UA alerts about “security audit” requests through AnyDesk
Oracle Critical Pre-Release update addressed 320 flaw
OWASP Reveils Top 10 Smart Contract Vulnerabilities for 2025
This vulnerability affects all versions of Cisco Meeting Management prior to the fixed release. Exploitation of this issue could give attackers significant control over systems, potentially disrupting business operations.
The following software releases are impacted:
Versions 3.8 and earlier: Users are advised to migrate to a fixed release.
Version 3.9: Patched in version 3.9.1.
Version 3.10: Not vulnerable.
Cisco has confirmed that there are no workarounds available to mitigate this vulnerability. The only solution is to apply the necessary software updates. Users are advised to consult the advisory for detailed information on affected and fixed releases.
Cisco has provided free software updates to address the CVE-2025-20156 vulnerability. Customers with valid service contracts can access these updates via their regular update channels. Users without service contracts are advised to contact Cisco’s Technical Assistance Center (TAC) to obtain the necessary upgrades. For seamless updates, Cisco recommends verifying hardware compatibility and ensuring sufficient memory for the new software release.
Delay patching leaves about 50,000 Fortinet firewalls to zero-day attack
