Cisco Security Updates – 23 January 2025

The addressed vulnerabilities could allow the attacker to conduct denial of services attacks, bypass security restrictions, perform cross-site scripting attacks, obtain sensitive information, or gain elevated privileges and gain access to the affected systems.

Sample of the addressed vulnerabilities:

1. Cisco Meeting Management REST API Privilege Escalation Vulnerability (CVE-2025-20156):

• CVSS: 9.9
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low
• User Interaction: None
• Consequences: Privilege Escalation

2. Cisco BroadWorks SIP Denial of Service Vulnerability (CVE-2025-20165):

• CVSS: 7.5
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Consequences: Denial of Service

Sample of the affected products:

• Cisco Meeting Management.
• Cisco BroadWorks.
• Cisco ThousandEyes Endpoint Agents.
• Cisco Crosswork Network Controller.
• Cisco CSPC