InfoSecBulletin Cybersecurity for mankind
Cisco issued a security advisory about a serious vulnerability in its Webex App that allows unauthenticated remote code execution (RCE) via malicious meeting invite links. The flaw, known as CVE-2025-20236, has a CVSS score of 8.8 and affects several versions of the Cisco Webex desktop application.
“A vulnerability in the custom URL parser of Cisco Webex App could allow an unauthenticated, remote attacker to persuade a user to download arbitrary files, which could allow the attacker to execute arbitrary commands on the host of the targeted user,” Cisco stated in its advisory.
Linux flaws enable password hash theft via core dumps in Ubuntu, RHEL, Fedora
Australia enacts mandatory ransomware payment reporting
Why Govt Demands Foreign CCTV Firms to Submit Source Code?
CVE-2023-39780
Botnet hacks thousands of ASUS routers
Bangladesh Bank instructed using AI to prevent online gambling
251 Amazon-Hosted IPs Used in Exploit Scan for ColdFusion, Struts, and Elasticsearch
Zero-Trust Policy bypass to Exploit Vulns & Manipulate NHI Secrets
Evaly E-commerce Platform Allegedly Hacked
Exploitable Vulns in Canon Printers Allow Gaining Admin Privileges
184 Million Leaked Credentials Discovered in Open Database
The flaw is due to inadequate input validation in the Webex App’s handling of custom URLs. An attacker can create a malicious Webex meeting link that tricks users into clicking it, causing arbitrary files to download to their devices.
“A successful exploit could allow the attacker to execute arbitrary commands with the privileges of the targeted user,” Cisco warns. Any user with a vulnerable version of the Webex App is at risk, regardless of their operating system or configuration.
As of now, Cisco’s Product Security Incident Response Team (PSIRT) has not seen any malicious use or public exploitation of CVE-2025-20236.
Cisco has confirmed the following:
Versions 44.5 and earlier: Not vulnerable
Version 44.6: Fixed in 44.6.2.30589
Version 44.7: Must migrate to a fixed release
Versions 44.8 and later: Not vulnerable
Users are strongly advised to check their application version and update immediately to avoid exploitation.
Apple released emergency security updates for 2 zero-day vulns
