InfoSecBulletin Cybersecurity for mankind
Cisco issued a security advisory about a serious vulnerability in its Webex App that allows unauthenticated remote code execution (RCE) via malicious meeting invite links. The flaw, known as CVE-2025-20236, has a CVSS score of 8.8 and affects several versions of the Cisco Webex desktop application.
“A vulnerability in the custom URL parser of Cisco Webex App could allow an unauthenticated, remote attacker to persuade a user to download arbitrary files, which could allow the attacker to execute arbitrary commands on the host of the targeted user,” Cisco stated in its advisory.
Intel PC, laptop and server processors affected for 6 years: Report
CVSS 10.0 Flaw
Critical flaw in Siemens OZW Web Servers Enable Unauthenticated RCE
Microsoft Patch Tuesday May 2025: 72 flaws, 5 Actively Exploited Zero-Day
OTP glitch disrupted NID services across the country
Google to pay Texas $1.4 billion for location tracking practices
YouTube geo-blocks at least 4 Bangladeshi TV channels in India
Microsoft Patches Four Critical Azure and Power Apps Vulns
Qilin Ransomware topped April 2025 with 45+ data leak disclosures
SonicWall Patches 3 Flaws in SMA 100 Devices
Top Ransomware Actively Attacking Financial Sector: 406 Incidents Disclosed
The flaw is due to inadequate input validation in the Webex App’s handling of custom URLs. An attacker can create a malicious Webex meeting link that tricks users into clicking it, causing arbitrary files to download to their devices.
“A successful exploit could allow the attacker to execute arbitrary commands with the privileges of the targeted user,” Cisco warns. Any user with a vulnerable version of the Webex App is at risk, regardless of their operating system or configuration.
As of now, Cisco’s Product Security Incident Response Team (PSIRT) has not seen any malicious use or public exploitation of CVE-2025-20236.
Cisco has confirmed the following:
Versions 44.5 and earlier: Not vulnerable
Version 44.6: Fixed in 44.6.2.30589
Version 44.7: Must migrate to a fixed release
Versions 44.8 and later: Not vulnerable
Users are strongly advised to check their application version and update immediately to avoid exploitation.
Apple released emergency security updates for 2 zero-day vulns
