Cisco Webex Network Recording Player and Cisco Webex Player Arbitrary Code Execution Vulnerabilities

Vulnerability

The vulnerability affects Cisco Webex Network Recording Player for Microsoft Windows and Cisco Webex Player for Microsoft Windows. It exists due to insufficient validation of certain elements within Webex recordings stored in the Advanced Recording Format (ARF) or the Webex Recording Format (WRF). Multiple instances of this flaw were identified. Any version of the software prior to the fixed releases (as detailed in the Cisco security advisory [1]) is considered affected. The code path is reachable when a user opens a specially crafted ARF or WRF file with the affected software.

Exploitation

An attacker can exploit these vulnerabilities by delivering a malicious ARF or WRF file to a targeted user, either as a link or as an email attachment. The attacker must then persuade the user to open the file with the affected Cisco Webex Player or Network Recording Player on their local Windows system. No additional privileges or authentication are required beyond normal user interaction to open the file [1].

Impact

On successful exploitation, an attacker can execute arbitrary code on the affected system with the privileges of the targeted user. This could lead to complete compromise of the user's workstation, including data theft, installation of malware, or further lateral movement within the network [1].

Mitigation

Cisco has released free software updates to address these vulnerabilities. Customers should upgrade to the fixed versions indicated in the Cisco Security Advisory [1]. As of the advisory publication date (2019-11-06), no workarounds were available. Users should apply patches promptly. The vulnerability is not known to be listed in CISA's Known Exploited Vulnerabilities (KEV) catalog at the time of writing.