Cisco Webex Network Recording Player Remote Code Execution Vulnerabilities

Vulnerability

The vulnerability exists in the Cisco Webex Network Recording Player and Cisco Webex Player for Microsoft Windows. The software improperly validates Advanced Recording Format (ARF) and Webex Recording Format (WRF) files. An attacker can craft a malicious ARF or WRF file that, when opened by a user in the affected player, triggers arbitrary code execution. Affected versions include Cisco Webex Network Recording Player for Windows prior to version 1.3.7 and Cisco Webex Player for Windows prior to version 2.7.2. [1]

Exploitation

An attacker needs to send a malicious ARF or WRF file to a user, typically via email or a link, and convince the user to open it with the affected player. No special network position or authentication is required; user interaction is necessary. The attacker does not need write access or any other privilege beyond crafting the file. The exploitation sequence: attacker crafts file, sends it, user opens it, code executes. [1]

Impact

Successful exploitation leads to arbitrary code execution on the affected system, with the privileges of the user running the player. This could result in full system compromise if the user has high privileges. The impact is remote code execution (RCE) with no privilege escalation beyond the user's context. [1]

Mitigation

Cisco has released free software updates that address the vulnerability. Customers should upgrade to Cisco Webex Network Recording Player version 1.3.7 or later (Windows), and Cisco Webex Player version 2.7.2 or later (Windows). The advisory [1] provides details. No workarounds are mentioned. Customers without service contracts should contact Cisco TAC for upgrades. [1]