CVE-2025-20156
Cisco Meeting Management ≤ 3.9.1
Raw vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HSummary
CVE-2025-20156 is a critical-severity Improper Handling of Insufficient Privileges (CWE-274) vulnerability in Cisco Meeting Management. Its CVSS base score is 9.9 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked in the top 35% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-24 (Access Control Decisions) and AC-25 (Reference Monitor) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
A vulnerability in the REST API of Cisco Meeting Management stems from improper enforcement of authorization checks for authenticated users. The affected component allows remote, low-privileged attackers to interact with specific endpoints that should be restricted to administrators, resulting in a CVSS 9.9 rating that reflects high impact across confidentiality, integrity, and availability on managed systems.
An authenticated attacker with low privileges can exploit the flaw by crafting requests to an unprotected API endpoint, thereby elevating their access to administrator level. Successful exploitation grants full control over edge nodes managed by the Cisco Meeting Management instance, affecting any deployment where the REST API is reachable over the network.
The Cisco Security Advisory cisco-sa-cmm-privesc-uy2Vf8pc addresses the issue and is the authoritative source for mitigation steps and patch availability. The two ClamAV references are unrelated to this CVE.
EPSS for the vulnerability rose from a low baseline to a peak of 0.0347, indicating emerging exploitation interest after disclosure that warrants renewed attention despite the current score of 0.0148.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-2156
Vulnerability Data
A vulnerability in the REST API of Cisco Meeting Management could allow a remote, authenticated attacker with low privileges to elevate privileges to administrator on an affected device. This vulnerability exists because proper authorization is not enforced upon REST API users.…
more
An attacker could exploit this vulnerability by sending API requests to a specific endpoint. A successful exploit could allow the attacker to gain administrator-level control over edge nodes that are managed by Cisco Meeting Management.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 5 hardening rules · 3 OS baselines
—
Mitigating Controls (NIST 800-53 r5) AI
Always-invoked reference monitor guarantees privilege checks occur and cannot be bypassed or mishandled.
Enforces approved authorizations so insufficient privileges produce a proper denial instead of mishandled failure.
Requires every access request to be decided against current authorizations, preventing ad-hoc privilege handling.
Least-privilege assignment reduces the frequency of operations that encounter insufficient privileges.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Enforcing least-privilege access policies directly prevents improper handling of insufficient privileges.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Privileged-access-rights control directly limits the situations in which insufficient privileges can occur.
Information-access-restriction mechanisms enforce least-privilege checks that mitigate the weakness at runtime.
Access control policy defines privilege boundaries but does not guarantee correct runtime handling when privileges prove insufficient.
Access-rights provisioning and review reduce privilege gaps, yet do not address the software’s failure to handle insufficient privileges gracefully.
Restricting privileged utilities reduces exposure but does not address how the application handles privilege shortfalls.
Secure SDLC practices can include privilege checks, yet the control itself does not mandate handling of insufficient privileges.
Hardening callouts derived
Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (authoritative rows only; rows rated `none` are excluded).
Oracle Linux 9 (2 rules)
- V-271452 OL 9 must use a Linux Security Module configured to enforce limits on system services. prevents CWE-274
- V-271640 OL 9 must be configured so that the Network File System (NFS) is configured to use RPCSEC_GSS. prevents CWE-274
RHEL 9 (1 rule)
- V-258078 RHEL 9 must use a Linux Security Module configured to enforce limits on system services. prevents CWE-274