Cisco Webex Network Recording Player Remote Code Execution Vulnerabilities

Vulnerability

The vulnerability is due to improper validation of Advanced Recording Format (ARF) and Webex Recording Format (WRF) files within the Cisco Webex Network Recording Player for Windows (versions 2.20.0.0 and earlier) and the Cisco Webex Player for Windows (versions 1.3.0.0 and earlier) [1]. An attacker could exploit this by sending a malicious file that triggers arbitrary code execution.

Exploitation

An attacker requires no special authentication or network position; they only need to send a malicious ARF or WRF file to a user via a link or email attachment and persuade the user to open it with the affected software [1]. No additional privileges are necessary; the attack relies on user interaction.

Impact

Successful exploitation allows the attacker to execute arbitrary code on the victim's system with the privileges of the user running the player software [1]. This could lead to full compromise of the affected system, including data theft, installation of malware, or further attacks.

Mitigation

Cisco has released free software updates that remediate this vulnerability. Customers should upgrade to Cisco Webex Network Recording Player version 2.20.0.1 or later, and Cisco Webex Player version 1.3.0.1 or later [1]. Customers without a service contract may obtain updates by contacting the Cisco TAC. No workarounds are available.