Analysis Summary

CVE-2025-20128 CVSS:5.3

A vulnerability in the Object Linking and Embedding 2 (OLE2) decryption routine of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.

CVE-2025-20156 CVSS:9.9

A vulnerability in the REST API of Cisco Meeting Management could allow a remote, authenticated attacker with low privileges to elevate privileges to administrator on an affected device.

CVE-2025-20165 CVSS:7.5

A vulnerability in the SIP processing subsystem of Cisco BroadWorks could allow an unauthenticated, remote attacker to halt the processing of incoming SIP requests, resulting in a denial of service (DoS) condition.

Impact

• Denial of Service
• Buffer Overflow
• Privilege Escalation

Indicators of Compromise

CVE

• CVE-2025-20128

• CVE-2025-20156

• CVE-2025-20165

Affected Vendors

Remediation

Refer to Cisco Security Advisory for patch, upgrade, or suggested workaround information.

CVE-2025-20128

CVE-2025-20156

CVE-2025-20165