Cisco Webex Network Recording Player Arbitrary Code Execution Vulnerabilities

Vulnerability

The vulnerability exists in the Cisco Webex Network Recording Player (WNRP) and Webex Player for Microsoft Windows. The software improperly validates Advanced Recording Format (ARF) and Webex Recording Format (WRF) files, leading to a buffer overflow condition. Affected versions include all releases prior to the fixed versions specified in the Cisco Security Advisory [1]. Successful exploitation requires the user to open a specially crafted ARF or WRF file with the vulnerable player.

Exploitation

An attacker can exploit this vulnerability by sending a malicious ARF or WRF file to a target user, either via a link or as an email attachment, and then persuading the user to open the file with the affected Cisco Webex Network Recording Player or Webex Player. No additional authentication or network position is required beyond the ability to deliver the file to the user [1].

Impact

Successful exploitation allows the attacker to execute arbitrary code on the affected system. The code runs in the context of the logged-on user, potentially granting the attacker the same privileges as the user. This can lead to full compromise of the system, including data exfiltration, installation of malware, or further lateral movement [1].

Mitigation

Cisco has released free software updates to address this vulnerability. Customers should upgrade to the fixed versions as identified in the Cisco Security Advisory [1]. No workarounds are available. The vulnerability is not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog.