CVE-2020-3495— Cisco Jabber for Windows Message Handling Arbitrary Code Execution Vulnerability
Quick assessment
Affected
Cisco Cisco Jabber
Exploitation
High exploitation probability; assess promptly
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Cisco Jabber for Windows和Cisco Jabber都是美国思科（Cisco）公司的产品。Cisco Jabber for Windows是一套用于Windows平台的统一通信客户端解决方案。该方案提供了在线状态显示、即时消息、语音等功能。Cisco Jabber是一套统一通信客户端解决方案。该方案提供了在线状态显示、即时消息、语音等功能。 Windows中的Cisco Jabber存在输入验证错误漏洞，该漏洞源于对邮件内容的不正确验证，攻击者可借助该漏洞使应用程序在目标系统上执行任
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2020-3495
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Cisco Jabber for Windows Message Handling Arbitrary Code Execution Vulnerability
Source: CVE Program / CVE List V5
Vulnerability Description
A vulnerability in Cisco Jabber for Windows could allow an authenticated, remote attacker to execute arbitrary code. The vulnerability is due to improper validation of message contents. An attacker could exploit this vulnerability by sending specially crafted Extensible Messaging and Presence Protocol (XMPP) messages to the affected software. A successful exploit could allow the attacker to cause the application to execute arbitrary programs on the targeted system with the privileges of the user account that is running the Cisco Jabber client software, possibly resulting in arbitrary code execution.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
输入验证不恰当
Source: CVE Program / CVE List V5
Vulnerability Title
Cisco Jabber 输入验证错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Cisco Jabber for Windows和Cisco Jabber都是美国思科（Cisco）公司的产品。Cisco Jabber for Windows是一套用于Windows平台的统一通信客户端解决方案。该方案提供了在线状态显示、即时消息、语音等功能。Cisco Jabber是一套统一通信客户端解决方案。该方案提供了在线状态显示、即时消息、语音等功能。 Windows中的Cisco Jabber存在输入验证错误漏洞，该漏洞源于对邮件内容的不正确验证，攻击者可借助该漏洞使应用程序在目标系统上执行任
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Cisco | Cisco Jabber | n/a | - |
|
II. Public POCs for CVE-2020-3495
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2020-3495
请登录查看更多情报信息。
Vendor Advisories for CVE-2020-3495 (1)
-
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-jabber-UyTKCPGg vendor-advisory x_refsource_CISCO
Same Patch Batch · Cisco · 2020-09-04 · 15 CVEs total
| CVE-2020-3430 | 8.8 HIGH | Cisco Jabber for Windows Protocol Handler Command Injection Vulnerability |
| CVE-2020-3530 | 8.4 HIGH | Cisco IOS XR Authenticated User Privilege Escalation Vulnerability |
| CVE-2020-3478 | 8.1 HIGH | Cisco Enterprise NFV Infrastructure Software File Overwrite Vulnerability |
| CVE-2020-3498 | 6.5 MEDIUM | Cisco Jabber for Windows Information Disclosure Vulnerability |
| CVE-2020-3545 | 6.0 MEDIUM | Cisco FXOS Software Buffer Overflow Vulnerability |
| CVE-2020-3537 | 5.7 MEDIUM | Cisco Jabber for Windows Universal Naming Convention Link Handling Vulnerability |
| CVE-2020-3542 | 5.3 MEDIUM | Cisco Webex Training Unauthorized Meeting Join Vulnerability |
| CVE-2020-3451 | 4.7 MEDIUM | Cisco Small Business RV340 Series Routers Command Injection and Remote Code Execution Vuln |
| CVE-2020-3453 | 4.7 MEDIUM | Cisco Small Business RV340 Series Routers Command Injection and Remote Code Execution Vuln |
| CVE-2020-3541 | 4.4 MEDIUM | Cisco Webex Meetings Client for Windows, Webex Meetings Desktop App, and Webex Teams Infor |
| CVE-2020-3547 | 4.3 MEDIUM | Cisco Email Security Appliance, Cisco Content Security Management Appliance, and Cisco Web |
| CVE-2020-3365 | 4.3 MEDIUM | Cisco Enterprise NFV Infrastructure Software Path Traversal Vulnerability |
| CVE-2020-3473 | Cisco IOS XR Software Authenticated User Privilege Escalation Vulnerability | |
| CVE-2020-3546 | Cisco Email Security Appliance Information Disclosure Vulnerability |
IV. Related Vulnerabilities
Same product: Cisco Jabber
-
CVE-2022-20917
Cisco Jabber 安全漏洞 -
CVE-2021-1569
Cisco Jabber Desktop and Mobile Client Software Vulnerabilit -
CVE-2021-1570
Cisco Jabber Desktop and Mobile Client Software Vulnerabilit -
CVE-2021-1418
Cisco Jabber Desktop and Mobile Client Software Vulnerabilit -
CVE-2021-1417
Cisco Jabber Desktop and Mobile Client Software Vulnerabilit
Same vendor: Cisco
-
CVE-2026-20320
Cisco BroadWorks OCI解析器XEE漏洞 -
CVE-2026-20327
Cisco Unified Intelligence Center SQL Injection Vulnerabilit -
CVE-2026-20314
Cisco Packaged Contact Center Enterprise & Cisco Unified Con -
CVE-2026-20319
Cisco Secure Workload Software Security Hardening Release Au -
CVE-2026-20315
Cisco Secure Workload Software Security Hardening Release Au
Same weakness: CWE-20
-
CVE-2026-34959
Adminer before 5.5.0 Open Redirect via X-Forwarded-Prefix -
CVE-2026-16434
Adminer before 5.5.1 X-Forwarded-Prefix Backslash Bypass -
CVE-2026-55371
OpenEXR: OpenEXRCore exr_attr_set_bytes() accepts NULL type_ -
CVE-2026-72711
Lean 4 before 4.32.2 Kernel Accepts Opaque Declaration With -
CVE-2026-76816
Netty: MQTT Topic Name and Client ID Validation Bypass
V. Comments for CVE-2020-3495
No comments yet