Report feedback

Allows an authenticated remote attacker, due to insufficient user authorization in the REST API, to elevate their privileges to administrator and gain control over the edge nodes managed by Cisco Meeting Management [1].

The vulnerability is present in product:

• *:Cisco Meeting Management;

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

More information:

• CVE-2025-20156 at cve.org, NVD
• CWE-274: Improper Handling of Insufficient Privileges at cwe.mitre.org

The vulnerability was publicly disclosed 22. 1. 2025.

Allows an unauthenticated remote attacker, due to improper memory handling under a large number of SIP requests, to exhaust the memory of the Cisco BroadWorks system and thus cause a denial-of-service condition [2].

The vulnerability is present in product:

• *:Cisco BroadWorks;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

More information:

• CVE-2025-20165 at cve.org, NVD
• CWE-789: Memory Allocation with Excessive Size Value at cwe.mitre.org

The vulnerability was publicly disclosed 22. 1. 2025.

Allows an unauthenticated remote attacker, due to an "integer underflow" in a boundary check in the OLE2 decoding routine of ClamAV, to cause a stack buffer overflow and, by terminating the scanning process, perform a denial of service [3].

The vulnerability is present in product:

• *:Cisco ClamAV;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

More information:

• CVE-2025-20128 at cve.org, NVD
• CWE-122: Heap-based Buffer Overflow at cwe.mitre.org

The vulnerability was publicly disclosed 22. 1. 2025.