Cisco has patched a critical vulnerability in its Meeting Management software that could allow attackers to gain administrator privileges on vulnerable systems.
Tracked as CVE-2025-20156 and carrying a CVSS score of 9.9, the flaw resides in the REST API of Cisco Meeting Management. The issue stems from improper authorization checks in the API, enabling authenticated attackers to exploit the vulnerability by sending requests to specific endpoints.
“A successful exploit could allow the attacker to gain administrator-level control over edge nodes managed by Cisco Meeting Management,” Cisco stated in its advisory.
The flaw was reported by security researcher Ben Leonard-Lagarde from Modux. Cisco has confirmed that no workarounds are available and urges customers to update to the appropriate fixed software versions:
- Cisco Meeting Management release version 3.9 (Patched in 3.9.1)
- Cisco Meeting Management release versions 3.8 and earlier (Migrate to a fixed release)
- Cisco Meeting Management release version 3.10 (Not vulnerable)
Cisco’s Product Security Incident Response Team (PSIRT) noted that, to date, there have been no reported cases of this vulnerability being exploited in the wild. The company advises users to upgrade their software to a fixed release as soon as possible.
Comments