Severity
Medium
Analysis Summary
CVE-2025-20206 CVSS:7.1
Cisco Secure Client for Windows could allow a local authenticated to perform a DLL hijacking attack on an affected device if the Secure Firewall Posture Engine, formerly HostScan, is installed on Cisco Secure Client. An attacker could exploit this vulnerability to execute arbitrary code on the system.
CVE-2025-20208 CVSS:4.6
Cisco TelePresence Management Suite (TMS) is vulnerable to cross-site scripting, caused by insufficient input validation by the web-based management interface. A remote authenticated attacker could conduct a cross-site scripting (XSS) attack against a user of the interface.
Impact
- Code Execution
- Cross-Site Scripting
Indicators of Compromise
CVE
CVE-2025-20206
CVE-2025-20208
Affected Vendors
- Cisco
Affected Products
- Cisco Secure Client
- Cisco TelePresence Management Suite (TMS) - 15.13.6
Remediation
Refer to Cisco Security Advisory for patch, upgrade, or suggested workaround information.