Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
A vulnerability in the custom URL parser of Cisco Webex App could allow an unauthenticated, remote attacker to persuade a user to download arbitrary files, which could allow the attacker to execute arbitrary commands on the host of the targeted user. This vulnerability is due to insufficient input validation when Cisco Webex App processes a meeting invite link. An attacker could exploit this vulnerability by persuading a user to click a crafted meeting invite link and download arbitrary files. A successful exploit could allow the attacker to execute arbitrary commands with the privileges of the targeted user.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
6 versions affected across 1 product
🚨 Cisco patched critical Webex flaw (CVE-2025-20236): client-side RCE via crafted meeting links in App v44.6 (<44.6.2.30589) & v44.7. Update now to block arbitrary code execution. #Cisco #Webex #Cybersecurity #RCE https://t.co/Qbgorrxnvs
Post summary
Cisco has released a patch for CVE‑2025‑20236, a client‑side RCE in Webex (v44.6 and v44.7); users are urged to update immediately to prevent arbitrary code execution.
6 of 6 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | cisco | webex_teams | 44.6 | - | - |
| App | cisco | webex_teams | 44.6.0.29928 | - | - |
| App | cisco | webex_teams | 44.6.0.30148 | - | - |
| App | cisco | webex_teams | 44.7 | - | - |
| App | cisco | webex_teams | 44.7.0.30141 | - | - |
| App | cisco | webex_teams | 44.7.0.30285 | - | - |