CVE-2025-20236: high-severity vulnerability in Cisco Webex Teams
Cisco Webex App Client-Side Remote Code Execution Vulnerability
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.8epss 1.0%
A vulnerability in the custom URL parser of Cisco Webex App could allow an unauthenticated, remote attacker to persuade a user to download arbitrary files, which could allow the attacker to execute arbitrary commands on the host of the targeted user.
This vulnerability is due to insufficient input validation when Cisco Webex App processes a meeting invite link. An attacker could exploit this vulnerability by persuading a user to click a crafted meeting invite link and download arbitrary files. A successful exploit could allow the attacker to execute arbitrary commands with the privileges of the targeted user.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
Cisco · Cisco Webex TeamsRelated CVEs — Cisco Webex Teams
In the same product, most dangerous first.
CVE-2019-1636HIGHCisco Webex Teams URI Handler Insecure Library Loading VulnerabilityEPSS 46.9%CVE-2019-1939HIGHCisco Webex Teams Logging Feature Command Execution VulnerabilityEPSS 4.3%CVE-2020-3131MEDIUMCisco Webex Teams Adaptive Cards Denial of Service VulnerabilityEPSS 2.2%CVE-2019-1689HIGHCisco Webex Teams for iOS Arbitrary File Upload VulnerabilityEPSS 1.6%CVE-2021-1242MEDIUMCisco Webex Teams Shared File Manipulation VulnerabilityEPSS 1.4%CVE-2018-0436—Cisco Webex Teams Information Disclosure and Modification VulnerabilityEPSS 1.3%