Cisco Webex Network Recording Player Arbitrary Code Execution Vulnerability

Vulnerability

A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerability exists because the affected software improperly validates Advanced Recording Format (ARF) and Webex Recording Format (WRF) files. Affected versions include Cisco Webex Network Recording Player prior to 4.10 MR6 Security Patch 1 (build 4.10.6.2) and Cisco Webex Player prior to 4.10 MR6 Security Patch 1 (build 4.10.6.2). [1]

Exploitation

An attacker can exploit this vulnerability by sending a malicious ARF or WRF file to a user via a link or email attachment and persuading the user to open the file with the affected software on their local system. No special network position or authentication is required; only user interaction is needed. The attacker crafts a file that, when opened, triggers arbitrary code execution within the context of the user's privileges. [1]

Impact

Successful exploitation allows the attacker to execute arbitrary code on the user's system with the privileges of the user running the Webex player software. This could lead to full compromise of the affected system, including data theft, installation of malware, or further attacks. [1]

Mitigation

Cisco has released free software updates that address this vulnerability. The fixed versions are Cisco Webex Network Recording Player 4.10 MR6 Security Patch 1 (build 4.10.6.2) and Cisco Webex Player 4.10 MR6 Security Patch 1 (build 4.10.6.2). Customers who cannot upgrade may mitigate by not opening ARF or WRF files from untrusted sources. [1]