CVE-2025-20236
Published: 16 April 2025
Summary
CVE-2025-20236 is a high-severity Inclusion of Functionality from Untrusted Control Sphere (CWE-829) vulnerability in Cisco Webex Teams. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 21.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2025-20236 affects the custom URL parser component in the Cisco Webex App and arises from insufficient input validation during processing of meeting invite links. The flaw is tracked under CWE-829 and carries a CVSS 3.1 score of 8.8.
An unauthenticated remote attacker can exploit the vulnerability by sending a crafted meeting invite link to a target user. If the user clicks the link, the attacker can cause arbitrary files to be downloaded and executed, resulting in arbitrary command execution on the user's host under the privileges of the targeted account.
The official Cisco Security Advisory at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-app-client-rce-ufyMMYLC addresses mitigation steps for the issue. The associated EPSS score remains flat at 0.0116 with no material increase observed.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-11394
Vulnerability details
A vulnerability in the custom URL parser of Cisco Webex App could allow an unauthenticated, remote attacker to persuade a user to download arbitrary files, which could allow the attacker to execute arbitrary commands on the host of the targeted…
more
user. This vulnerability is due to insufficient input validation when Cisco Webex App processes a meeting invite link. An attacker could exploit this vulnerability by persuading a user to click a crafted meeting invite link and download arbitrary files. A successful exploit could allow the attacker to execute arbitrary commands with the privileges of the targeted user.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Limiting P2P file sharing technology reduces inclusion of functionality or resources from untrusted external control spheres.
Enforcing installation policies prevents users from including functionality obtained from untrusted control spheres.
The inventory process requires identifying and recording the origin of all components, making inclusion of functionality from untrusted control spheres easier to detect during reviews.
Requiring approval and monitoring of maintenance tools prevents inclusion and execution of functionality obtained from untrusted sources.
Unowned portable devices represent untrusted control spheres; the prohibition prevents inclusion of functionality or data from such sources.
Strategy mandates assessment of third-party components and suppliers, directly reducing inclusion of functionality from untrusted control spheres.
Procedures can mandate supply-chain vetting and restrictions on functionality obtained from untrusted third-party or external control spheres.
Requires use of trusted sources and provenance tracking, tangibly limiting inclusion of functionality from untrusted control spheres.