Cisco Meeting Management up to 3.9.0 REST API insufficient privileges

Summaryinfo

A vulnerability has been found in Cisco Meeting Management up to 3.9.0 and classified as very critical. The affected element is an unknown function of the component REST API. Performing a manipulation results in insufficient privileges. This vulnerability is cataloged as CVE-2025-20156. It is possible to initiate the attack remotely. There is no exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability, which was classified as very critical, was found in Cisco Meeting Management up to 3.9.0. This affects an unknown part of the component REST API. The manipulation with an unknown input leads to a insufficient privileges vulnerability. CWE is classifying the issue as CWE-274. The product does not handle or incorrectly handles when it has insufficient privileges to perform an operation, leading to resultant weaknesses. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

A vulnerability in the REST API of Cisco Meeting Management could allow a remote, authenticated attacker with low privileges to elevate privileges to administrator on an affected device. This vulnerability exists because proper authorization is not enforced upon REST API users. An attacker could exploit this vulnerability by sending API requests to a specific endpoint. A successful exploit could allow the attacker to gain administrator-level control over edge nodes that are managed by Cisco Meeting Management.

It is possible to read the advisory at sec.cloudapps.cisco.com. This vulnerability is uniquely identified as CVE-2025-20156 since 10/10/2024. The exploitability is told to be easy. It is possible to initiate the attack remotely. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 08/01/2025). The attack technique deployed by this issue is T1068 according to MITRE ATT&CK.

Upgrading eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• Cisco

Name

• Meeting Management

Version

• 2.9.0
• 2.9.1
• 3.1.0
• 3.2.0
• 3.4.0
• 3.5.0
• 3.6.0
• 3.6.1
• 3.7.0
• 3.8.0
• 3.9.0

License

• commercial

Website

• Vendor: https://www.cisco.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion