Cisco Webex Network Recording Player and Cisco Webex Player Remote Code Execution Vulnerabilities

Vulnerability

The vulnerability exists in the Cisco Webex Network Recording Player and Cisco Webex Player for Microsoft Windows due to improper validation of Advanced Recording Format (ARF) and Webex Recording Format (WRF) files. Affected versions include all releases prior to the fixed versions provided in the Cisco security advisory [1]. An attacker can exploit this by crafting a malicious ARF or WRF file and delivering it to a target user.

Exploitation

An attacker must convince a user to open a malicious ARF or WRF file using the affected software. This can be achieved by sending the file via a link or email attachment. No special network position or authentication is required; the user must interact by opening the file.

Impact

Successful exploitation allows the attacker to execute arbitrary code on the affected system with the privileges of the user running the player. This can lead to full compromise of the system, including data theft, installation of malware, or further network propagation.

Mitigation

Cisco has released software updates to address this vulnerability [1]. Users should update to the fixed versions as specified in the advisory. No workarounds are available; upgrading is the only mitigation. The vulnerability is not known to be in the CISA KEV catalog as of the advisory date.