A critical vulnerability in Cisco Webex App that could allow attackers to execute malicious code on target systems through specially crafted meeting invitation links.
The high-severity flaw, tracked as CVE-2025-20236, has prompted Cisco to release emergency patches for affected versions of the popular collaboration platform.
The security flaw assigned a CVSS base score of 8.8 (High), exists in the Cisco Webex App’s custom URL parser component.
Cisco Webex App Remote Code Execution Vulnerability
According to Cisco’s security advisory (cisco-sa-webex-app-client-rce-ufyMMYLC), the vulnerability stems from “insufficient input validation when Cisco Webex App processes a meeting invite link.”
This deficiency allows attackers to deliver and execute arbitrary code on victims’ systems. The vulnerability is classified under CWE-829, which relates to including functionality from an untrusted control sphere.
The complete CVSS vector string for this vulnerability indicates that exploitation requires user interaction but can compromise confidentiality, integrity, and availability completely.
Exploiting this vulnerability follows a straightforward attack chain. An attacker begins by crafting a malicious Webex meeting URL that exploits the parser vulnerability.
When unsuspecting users click on this weaponized meeting link, the vulnerable Webex client processes it without proper validation, allowing the download of arbitrary files.
This vulnerability is particularly dangerous because it can lead to remote code execution with the privileges of the targeted user.
Once arbitrary files are downloaded through the crafted link, commands can be executed on the victim’s system without additional authorization requirements.
The vulnerability was discovered during Cisco’s internal security testing, suggesting it was identified and patched before malicious actors could discover and exploit it in the wild.
| Risk Factors | Details |
| Affected Products | Cisco Webex App Desktop versions 44.6.0.29928 – 44.7.0.30285 |
| Impact | Remote code execution |
| Exploit Prerequisites | User must click a weaponized meeting invite link (user interaction) |
| CVSS 3.1 Score | 8.8 (High) |
Affected Systems
According to Cisco’s advisory published on April 16, 2025, the vulnerability affects specific versions of the Cisco Webex App across all operating systems and configurations. The following versions are vulnerable:
- Cisco Webex App 44.6 (prior to version 44.6.2.30589)
- Cisco Webex App 44.7 (all releases)
Notably, this vulnerability does not affect versions 44.5 and earlier, as well as 44.8 and later.
Cisco has released security updates that address the vulnerability. For users running version 44.6, upgrading to version 44.6.2.30589 or later will patch the vulnerability.
Users on version 44.7 must migrate to a fixed release, as no direct patch is available for this version.
The company notes that no workarounds are available for this vulnerability, making patching the only effective mitigation strategy. Organizations using the Cisco Webex App are strongly advised to update their installations immediately.
Although Cisco’s Product Security Incident Response Team (PSIRT) states they are “not aware of any public announcements or malicious use of the vulnerability,” security experts warn that weaponization could happen quickly now that the vulnerability has been disclosed.
Organizations should prioritize patching based on the high CVSS score and the widespread use of Webex in corporate environments.
Malware Trends Report Based on 15000 SOC Teams Incidents, Q1 2025 out!-> Get Your Free Copy
