CVE-2025-20291
BaseFortify
Publication date: 2025-09-03
Last updated on: 2025-09-09
Assigner: Cisco Systems, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| cisco | webex_meetings | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-601 | The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a URL redirection flaw in Cisco Webex Meetings caused by insufficient validation of URLs included in meeting-join URLs. An unauthenticated, remote attacker could craft a malicious Webex Meetings join URL containing a link to an attacker-controlled website. When a targeted user clicks this URL, they could be redirected to the malicious site, which might appear trusted due to its association with Webex, increasing the risk of phishing attacks. [1]
How can this vulnerability impact me? :
If exploited, this vulnerability could redirect you to an attacker-controlled website when clicking a malicious Webex Meetings join URL. This redirection could lead to phishing attacks, where the attacker might trick you into revealing sensitive information or performing harmful actions, as the malicious site may appear trustworthy because of its link to Webex. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability cannot be detected on your network or system using specific commands because it is a flaw in the cloud-based Cisco Webex Meetings service itself. There are no on-premises software or device updates related to this issue, and no detection commands or tools are provided. The vulnerability involves URL redirection through crafted meeting-join URLs, which would require monitoring user interactions with such URLs rather than network or system scanning. [1]
What immediate steps should I take to mitigate this vulnerability?
No immediate steps are required from customers to mitigate this vulnerability because Cisco has addressed the issue in the Webex Meetings service itself. There are no updates or workarounds needed on customer devices or software. Customers are advised to contact Cisco TAC or their maintenance providers if they need further assistance. [1]