Cisco Webex Network Recording Player and Cisco Webex Player Remote Code Execution Vulnerabilities

Vulnerability

The vulnerability resides in the Cisco Webex Network Recording Player and Cisco Webex Player for Microsoft Windows. It stems from improper validation of Advanced Recording Format (ARF) and Webex Recording Format (WRF) files. Affected versions include those prior to T33.1110.0 for both players. An attacker can exploit this by crafting a malicious ARF or WRF file that, when processed by the vulnerable software, triggers arbitrary code execution [1].

Exploitation

To exploit this vulnerability, an attacker must deliver a malicious ARF or WRF file to a target user, typically via a link or email attachment, and convince the user to open the file using the affected Cisco Webex player. No authentication or special network position is required; the attack relies on user interaction. Once the user opens the file, the player processes the malformed data, leading to code execution [1].

Impact

Successful exploitation allows the attacker to execute arbitrary code on the victim's system with the privileges of the user running the Cisco Webex player. This can result in full compromise of the affected host, including data theft, installation of malware, or further lateral movement within the network [1].

Mitigation

Cisco has released software updates to address this vulnerability. The fixed version is T33.1110.0 for both Cisco Webex Network Recording Player and Cisco Webex Player. Users should upgrade to this or later versions. No workarounds are available. This vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog as of the publication date [1].