This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] Cisco fixes a high-severity vulnerability in Cisco Secure Client
Cisco fixes a high-severity vulnerability in its Cisco Secure Client for Windows product with version 5.1.8.105 [1]. The company also draws attention to a vulnerability in Cisco TelePresence Management Suite, which has already reached end of life [2]. As no further updates will be released for this software, it recommends that customers review the official end-of-support announcement [3].
An authenticated local attacker can execute arbitrary code with SYSTEM privileges by sending a forged IPC message to a specific Cisco Secure Client process [1].
The vulnerability is present in product:
- *:Cisco Secure Client; <5.1.8.105
CVSS: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
More information:
- CVE-2025-20206 at cve.org, NVD
- CWE-347: Improper Verification of Cryptographic Signature at cwe.mitre.org
The vulnerability was publicly disclosed 5. 3. 2025.
An authenticated remote attacker can perform an XSS attack in Cisco TelePresence Management Suite by injecting malicious data into a specific data field in the interface [2].
The vulnerability is present in product:
- *:Cisco TelePresence Management Suite; =15.13.6
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
More information:
- CVE-2025-20208 at cve.org, NVD
- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') at cwe.mitre.org
The vulnerability was publicly disclosed 5. 3. 2025.
Links
- [1] https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-secure-dll-injection-AOyzEqSg
- [2] https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-tms-xss-vuln-WbTcYwxG
- [3] https://www.cisco.com/c/en/us/products/collateral/conferencing/telepresence-management-suite-tms/telepresence-management-system-eol.html
By CESNET, z.s.p.o. Michaela Jarošová on 6. 3. 2025.