Cisco Webex Network Recording Player and Cisco Webex Player Remote Code Execution Vulnerabilities

Vulnerability

The vulnerability resides in the Cisco Webex Network Recording Player and the Cisco Webex Player for Microsoft Windows. These applications improperly validate Advanced Recording Format (ARF) and Webex Recording Format (WRF) files, allowing an attacker to craft a malicious file that triggers arbitrary code execution when opened. Affected versions are those prior to the fixed releases detailed in the Cisco advisory [1].

Exploitation

An attacker can exploit this vulnerability by sending a specially crafted ARF or WRF file to a user, either through a link or as an email attachment. The attacker must then persuade the user to open the malicious file using the vulnerable Cisco Webex Player. No additional privileges are required; only user interaction is needed to trigger the exploit.

Impact

Successful exploitation allows the attacker to execute arbitrary code on the affected system. The code runs in the context of the currently logged-in user, potentially leading to full compromise of confidentiality, integrity, and availability of the system.

Mitigation

Cisco has released free software updates to address this vulnerability, as indicated in the security advisory [1]. Users should upgrade to the latest fixed version of the Cisco Webex Network Recording Player or Cisco Webex Player. As a workaround, users should avoid opening ARF or WRF files from untrusted sources.