Cisco Webex Network Recording Player and Cisco Webex Player Remote Code Execution Vulnerabilities

Vulnerability

The vulnerability exists in Cisco Webex Network Recording Player and Cisco Webex Player for Microsoft Windows due to improper validation of Advanced Recording Format (ARF) and Webex Recording Format (WRF) files. An attacker can craft a malicious ARF or WRF file that, when opened by the affected software, triggers arbitrary code execution. The affected versions are those prior to the fixed releases provided in Cisco's security advisory [1].

Exploitation

An attacker can exploit this vulnerability by sending a user a malicious ARF or WRF file via a link or email attachment and persuading the user to open the file using the vulnerable software. No additional authentication or network access is required beyond the user's interaction. The user must be running an affected version of the player on a Windows system.

Impact

Successful exploitation allows the attacker to execute arbitrary code on the affected system with the privileges of the user running the player. This could lead to full compromise of the system, including data theft, installation of malware, or further lateral movement within the network.

Mitigation

Cisco has released free software updates to address this vulnerability. Users should upgrade to the fixed versions as specified in the Cisco Security Advisory [1]. No workarounds are mentioned; the recommended mitigation is to apply the patch. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog as of the publication date.