Cisco Webex Meetings Desktop App and Cisco Webex Productivity Tools Update Service Command Injection Vulnerability

An authenticated, local attacker exploits insufficient validation of user-supplied parameters in the update service [CWE-78]. The attacker copies crafted files to a local folder and invokes the update service command with a malicious argument. Because the service runs with SYSTEM privileges, the crafted argument causes arbitrary command execution at that elevated level. In Active Directory deployments, the attack can also be triggered remotely via operating system remote management tools [ref_id=1].

The vulnerability resides in the update service of Cisco Webex Meetings Desktop App for Windows. The service does not properly validate version numbers of new files, allowing an unprivileged local attacker to invoke the update service command with a crafted argument and folder [ref_id=1].

Cisco addressed the vulnerability by improving validation of user-supplied parameters in the update service. The fix is included in Cisco Webex Meetings Desktop App releases 33.6.6 and 33.9.1, and in Cisco Webex Productivity Tools release 33.0.7 [ref_id=1]. No patch diff is available in the bundle, but the advisory confirms that the update service now properly validates version numbers and arguments before acting on them.

The public PoC at https://www.exploit-db.com/exploits/46479/ describes copying crafted files to a local attacker-controlled folder and invoking the update service command with a crafted argument. The advisory states: "The vulnerability can be exploited by copying to a local attacker" (text truncated in source) [ref_id=1].