How severe is CVE-2020-3131?

CVE-2020-3131 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.

Is CVE-2020-3131 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (80th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2020-3131?

CVE-2020-3131 affects Cisco Webex Teams. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2020-3131?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2020-3131 published?

CVE-2020-3131 was published on 2020-01-26 and last updated on 2026-06-17.

CVE-2020-3131

CVE-2020-3131 is a medium-severity vulnerability in Cisco Webex Teams with a CVSS 3.x base score of 6.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-400.

Key facts

Severity: Medium (CVSS 3.x base score 6.5)
CVSS v2: 4.0
EPSS exploit prediction: 2% (80th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-400
Affected product: Cisco Webex Teams
Published: 2020-01-26
Last modified: 2026-06-17

Description

A vulnerability in the Cisco Webex Teams client for Windows could allow an authenticated, remote attacker to cause the client to crash, resulting in a denial of service (DoS) condition. The attacker needs a valid developer account to exploit this vulnerability. The vulnerability is due to insufficient input validation when processing received adaptive cards. The attacker could exploit this vulnerability by sending an adaptive card with malicious content to an existing user of the Cisco Webex Teams client for Windows. A successful exploit could allow the attacker to cause the targeted user's client to crash continuously. This vulnerability was introduced in Cisco Webex Teams client for Windows Release 3.0.13131.

Frequently asked questions

What is CVE-2020-3131?: A vulnerability in the Cisco Webex Teams client for Windows could allow an authenticated, remote attacker to cause the client to crash, resulting in a denial of service (DoS) condition. The attacker needs a valid developer account to exploit this vulnerability. The vulnerability is due to insufficient input validation when processing received adaptive cards. The attacker could exploit this vulnerability by sending an adaptive card with malicious content to an existing user of the Cisco Webex Teams client for Windows. A successful exploit could allow the attacker to cause the targeted user's client to crash continuously. This vulnerability was introduced in Cisco Webex Teams client for Windows Release 3.0.13131.
How severe is CVE-2020-3131?: CVE-2020-3131 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.
Is CVE-2020-3131 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (80th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2020-3131?: CVE-2020-3131 affects Cisco Webex Teams. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2020-3131?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2020-3131 published?: CVE-2020-3131 was published on 2020-01-26 and last updated on 2026-06-17.

References

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-cards-dos-FWzNcXPq

Affected products (1)

cpe:2.3:a:cisco:webex_teams:*:*:*:*:*:*:*:*

More vulnerabilities in Cisco Webex Teams

CVE-2025-20236 — High (CVSS 8.8): A vulnerability in the custom URL parser of Cisco Webex App could allow an unauthenticated, remote attacker to persuade…
CVE-2019-1939 — High (CVSS 8.8): A vulnerability in the Cisco Webex Teams client for Windows could allow an unauthenticated, remote attacker to execute…
CVE-2018-0387 — High (CVSS 8.8): A vulnerability in Cisco Webex Teams (for Windows and macOS) could allow an unauthenticated, remote attacker to execute…
CVE-2018-0436 — High (CVSS 8.7): A vulnerability in Cisco Webex Teams, formerly Cisco Spark, could allow an authenticated, remote attacker to view and…
CVE-2021-1502 — High (CVSS 7.8): A vulnerability in Cisco Webex Network Recording Player for Windows and MacOS and Cisco Webex Player for Windows and…
CVE-2020-3535 — High (CVSS 7.8): A vulnerability in the loading mechanism of specific DLLs in the Cisco Webex Teams client for Windows could allow an…

All CVEs affecting Cisco Webex Teams →

Other CWE-400 (Uncontrolled Resource Consumption) vulnerabilities

CVE-2026-46775 — Critical (CVSS 9.9): Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.1.0.…
CVE-2025-61303 — Critical (CVSS 9.8): Hatching Triage Sandbox Windows 10 build 2004 (2025-08-14) and Windows 10 LTSC 2021(2025-08-14) contains a…
CVE-2025-43193 — Critical (CVSS 9.8): The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7,…
CVE-2025-24269 — Critical (CVSS 9.8): The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.4. An app may be able to…
CVE-2025-24264 — Critical (CVSS 9.8): The issue was addressed with improved memory handling. This issue is fixed in Safari 18.4, iOS 18.4 and iPadOS 18.4,…
CVE-2025-24260 — Critical (CVSS 9.8): The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5,…

Browse all CWE-400 (Uncontrolled Resource Consumption) vulnerabilities →