Product: Cisco Webex Meetings
Summary
A vulnerability in Cisco Webex Meetings could have allowed an unauthenticated, remote attacker to redirect a targeted Webex Meetings user to an untrusted website. This vulnerability existed due to insufficient validation of URLs in a meeting-join URL. An attacker could exploit this by including a malicious URL in a specific value of the join URL, potentially leading to phishing attacks.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 4.3 | CVE-2025-20291 |
Exploitation
To exploit this vulnerability, an attacker would need to craft a Cisco Webex Meetings join URL that includes a URL to a website they control. When a targeted user clicks on the join link, they would be redirected to the attacker’s website, which could be designed to appear trustworthy. This could lead to the user being tricked into providing sensitive information or performing actions that compromise their security.
Affected Products
- Cisco Webex Meetings: Vulnerable due to insufficient URL validation in meeting-join links.
Mitigation
Cisco has addressed this vulnerability in the Cisco Webex Meetings service, and no customer action is needed. Users are encouraged to ensure they are using the latest version of the service to benefit from the security improvements.