QwikSec

Security Database

CVE

CWE

Training

CVE Database
/

CVE-2025-20156

Back to search

CVE-2025-20156

Published: Jan 22, 2025

Modified: Feb 26, 2026

PUBLISHED

CVSS v3.1

9.9

CRITICAL

Description

A vulnerability in the REST API of Cisco Meeting Management could allow a remote, authenticated attacker with low privileges to elevate privileges to administrator on an affected device. This vulnerability exists because proper authorization is not enforced upon REST API users. An attacker could exploit this vulnerability by sending API requests to a specific endpoint. A successful exploit could allow the attacker to gain administrator-level control over edge nodes that are managed by Cisco Meeting Management.

VendorProductVersions

Cisco

Cisco Meeting Management

affected
CMM3.4.0
affected
CMM3.2.0
affected
CMM2.9.1
affected
CMM2.9.0
affected
CMM3.1.0

+6 more versions

Weaknesses (CWE)

CWE-274

CVSS v3.1 Details

CVSS v3.1 Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

References

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now