Product:
Cisco Meeting Management
Summary
A vulnerability in the Certificate Management feature of Cisco Meeting Management could allow an authenticated, remote attacker to upload arbitrary files, execute arbitrary commands, and elevate privileges to root on an affected system. This vulnerability is due to improper input validation in certain sections of the web-based management interface. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected system.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 8.8 | CVE-2026-20098 |
Exploitation
To exploit this vulnerability, the attacker must have valid credentials for a user account with at least the role of video operator. By sending a specially crafted HTTP request, the attacker can upload malicious files to the affected system. These files could overwrite system files processed by the root system account, allowing the attacker to execute arbitrary commands with root privileges.
Affected Products
- Cisco Meeting Management: Vulnerable due to improper input validation in the web-based management interface.
Mitigation
To mitigate this vulnerability, it is recommended to apply any available patches from Cisco and ensure that user accounts with elevated privileges are monitored and managed carefully. Additionally, restricting access to the web-based management interface can help reduce the risk of exploitation.