Cisco Webex Network Recording Player and Cisco Webex Player Remote Code Execution Vulnerabilities

Vulnerability

A remote code execution vulnerability exists in the Cisco Webex Network Recording Player and Cisco Webex Player for Microsoft Windows due to improper validation of Advanced Recording Format (ARF) and Webex Recording Format (WRF) files. Affected versions include Cisco Webex Network Recording Player and Cisco Webex Player prior to the fixed releases indicated in the vendor advisory [1]. The vulnerability is triggered when a user opens a specially crafted ARF or WRF file using the affected software.

Exploitation

To exploit this vulnerability, an attacker must send a malicious ARF or WRF file to a target user via a link or email attachment and persuade the user to open the file using the affected Cisco Webex player [1]. No additional authentication or network position beyond the user's interaction is required; the user simply opens the file with the vulnerable player.

Impact

Successful exploitation allows the attacker to execute arbitrary code on the affected system. The attacker gains the ability to run commands or install software with the privileges of the logged-on user, potentially leading to full compromise of the affected Windows host [1].

Mitigation

Cisco has released free software updates that address this vulnerability. Fixed versions are available from the Cisco Security Advisory; customers should upgrade to the latest unaffected versions as specified in the advisory [1]. No workarounds are mentioned in the available references; applying the patch is the recommended mitigation.