- Cisco found and fixed three vulnerabilities, including a high severity
- The problem of high difficulty was found in the Cisco Webex app
- It made it possible for criminals to run commands externally
Cisco has patched a vulnerability with high difficulty on its Webex video conference platform that allowed threat actors to mount Remote Code Execution (RCE) attacks against exposed final points.
The error was discovered in the custom URL -in a Cisco Webex app and is described as an “insufficient input validation” vulnerability.
“An striker could take advantage of this vulnerability by persuading a user to click on a designed meeting invitation link and download arbitrary files,” reads BUG’s NVD page. “A successful exploitation could allow the striker to perform arbitrary commands with the privileges of the targeted user.”
No revolution
Vulnerability is traced as CVE-2024-20236 and was awarded a severity of 8.8/10 (high).
Cisco further explained that the vulnerability is present in all older versions of the product, regardless of the operating system it is running, or system configurations.
The network giant also said there were no solutions to the error, so that is the only way to mitigate the risk of mitigating the risk.
While the most serious, it’s not the only vulnerability Cisco has recently treated. The company also fixed two more deficiencies, CVE-2025-20178 (6.0/10) and CVE-2025-20150 (5.3/10).
The former is a privilege scaling error in Secure Networks Analytics’ web-based management interface and allows threat players to run arbitrary controls as a mess, with admin credentials.
The latter was found in a Nexus dashboard and allows threat actors to enumerate LDAP -user accounts externally and separate valid accounts from the invalid.
The good news is that the vulnerabilities are not yet utilized in nature, reports bleeping computer, citing analysis from the company’s product safety event team (PSERT).
Cisco’s equipment, both software and hardware, are popular in both the company and in consumer households. It makes them a first -class goal of threat actors, both state -sponsored and profit -oriented.
Via Bleeping computer
