Cisco has released updates to address a critical vulnerability affecting Meeting Management that could allow a remote, authorized attacker to gain administrative privileges.
Specifically, the vulnerability, which is tracked as CVE-2025-20156, allows privilege escalation in the Cisco Meeting Management REST API.
“ This vulnerability exists because proper authorization is not enforced on REST API users ,” the company said . “ An attacker could exploit this vulnerability by sending API requests to a specific endpoint .”
See also: WordPress: Critical vulnerabilities in RealHome theme & Easy Real Estate plugin
The attacker can then gain administrator-level control over edge nodes managed by Cisco Meeting Management.
The vulnerability affects the following versions, regardless of device configuration:
• Cisco Meeting Management release version 3.9
• Cisco Meeting Management release versions 3.8 and earlier
• Cisco Meeting Management release version 3.10
Cisco has also released updates for another vulnerability tracked as CVE-2025-20165. It is a denial-of-service (DoS) vulnerability affecting BroadWorks. The issue has been fixed in version RI.2024.11.
See also: New botnet exploits vulnerabilities in cameras and routers
"An attacker could exploit this vulnerability by sending a large number of SIP requests to an affected system," Cisco said.
A third vulnerability that was fixed is CVE-2025-20128, a bug affecting ClamAV's Object Linking and Embedding 2 (OLE2) decryption routine, which could also lead to a DoS condition. Unfortunately, a PoC exploit has also been released for this vulnerability.
The above vulnerabilities highlight the importance of regularly updating software. In today's ever-evolving threat landscape, it is vital for organizations to have a robust system in place to monitor vulnerabilities and apply updates in a timely manner to mitigate potential risks.
See also: Oracle January Patch: Fixes 320 new vulnerabilities
In addition to regular updates, implementing proper access controls and restricting access to critical systems can help prevent unauthorized access and privilege escalation. Organizations should also consider conducting regular vulnerability assessments and penetration testing to proactively identify any weaknesses in their systems. This can help address potential vulnerabilities before they are exploited by malicious actors.
Additionally, building a strong security culture within an organization is equally important. Employees should be educated about the importance of security updates and the potential risks associated with not implementing them in a timely manner.
Source: thehackernews.com
