Cisco has released a security advisory concerning a critical privilege escalation vulnerability (CVE-2025-20156) in its Meeting Management software. With a daunting CVSS score of 9.9, this vulnerability poses a significant risk, as it could enable remote, authenticated attackers with minimal privileges to elevate their access to administrator status on compromised devices.
Cisco warns, “A successful exploit could allow the attacker to gain administrator-level control over edge nodes that are managed by Cisco Meeting Management.”
By infosecbulletin
/ Sunday , April 20 2025
You copy a password from your manager, thinking it's safe. Meanwhile, your phone is saving it in plain text. Samsung...
Read More
By infosecbulletin
/ Saturday , April 19 2025
A data leak involving 8 million UK healthcare worker records, including IDs and financial information, was caused by a misconfigured...
Read More
By infosecbulletin
/ Saturday , April 19 2025
GitHub has released security updates for GitHub Enterprise Server to fix several vulnerabilities, including a high-severity flaw that could allow...
Read More
By infosecbulletin
/ Friday , April 18 2025
Hackers can exploit a vulnerability in Asus routers to execute unauthorized functions. This serious issue, rated 9.2 out of 10,...
Read More
By infosecbulletin
/ Friday , April 18 2025
According to Shadowserver Foundation around 17,000 Fortinet devices worldwide have been compromised using a new technique called "symlink". This number...
Read More
By infosecbulletin
/ Friday , April 18 2025
A critical security flaw has been found in the Erlang/Open Telecom Platform (OTP) SSH implementation, allowing an attacker to run...
Read More
By infosecbulletin
/ Thursday , April 17 2025
On Wednesday, CISA alerted about increased breach risks due to the earlier compromise of legacy Oracle Cloud servers, emphasizing the...
Read More
By infosecbulletin
/ Thursday , April 17 2025
Cisco issued a security advisory about a serious vulnerability in its Webex App that allows unauthenticated remote code execution (RCE)...
Read More
By infosecbulletin
/ Thursday , April 17 2025
On Wednesday, Apple released urgent operating system updates to address two security vulnerabilities that had already been exploited in highly...
Read More
By infosecbulletin
/ Wednesday , April 16 2025
On April 15, 2025, Oracle released a Critical Patch Update for 378 flaws for its products. The patch update covers...
Read More
This vulnerability affects all versions of Cisco Meeting Management prior to the fixed release. Exploitation of this issue could give attackers significant control over systems, potentially disrupting business operations.
The following software releases are impacted:
Versions 3.8 and earlier: Users are advised to migrate to a fixed release.
Version 3.9: Patched in version 3.9.1.
Version 3.10: Not vulnerable.
Cisco has confirmed that there are no workarounds available to mitigate this vulnerability. The only solution is to apply the necessary software updates. Users are advised to consult the advisory for detailed information on affected and fixed releases.
Cisco has provided free software updates to address the CVE-2025-20156 vulnerability. Customers with valid service contracts can access these updates via their regular update channels. Users without service contracts are advised to contact Cisco’s Technical Assistance Center (TAC) to obtain the necessary upgrades. For seamless updates, Cisco recommends verifying hardware compatibility and ensuring sufficient memory for the new software release.
Delay patching leaves about 50,000 Fortinet firewalls to zero-day attack