PT-2025-1021 · Cisco · Cisco Thousandeyes Endpoint Agent

Konrad Porzezynski · Published 2025-01-08 · Updated 2025-07-22 · CVE-2025-20126

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Cisco ThousandEyes Endpoint Agent for macOS and RoomOS (affected versions not specified)

Description A vulnerability in the certification validation routines of the affected software could allow an unauthenticated, remote attacker to intercept or manipulate metrics information. This issue exists because the software does not properly validate certificates for hosted metrics services. An on-path attacker could exploit this vulnerability by intercepting network traffic using a crafted certificate, potentially allowing the attacker to masquerade as a trusted host and monitor or change communications between the remote metrics service and the vulnerable client.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

BDU:2025-00218

CVE-2025-20126

Affected Products

Cisco Thousandeyes Endpoint Agent

References · 12

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-thousandeyes-cert-pqtJUv9N · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-00218 · Security Note
• https://osv.dev/vulnerability/CVE-2025-20126 · Vendor Advisory
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-xwork-xss-KCcg7WwU · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-20126 · Security Note
• https://twitter.com/VulmonFeeds/status/1877038918043898272 · Twitter Post
• https://twitter.com/SystemTek_UK/status/1877302148519629029 · Twitter Post
• https://t.me/cvenotify/129836 · Telegram Post
• https://t.me/cvedetector/14688 · Telegram Post
• https://twitter.com/CVEnew/status/1877026633510539417 · Twitter Post
• https://twitter.com/SystemTek_UK/status/1880241988802429071 · Twitter Post
• https://t.me/cveNotify/129836 · Telegram Post