Cisco Webex Meetings Desktop App for Mac Update Feature Code Execution Vulnerability

Vulnerability

The vulnerability resides in the software update feature of Cisco Webex Meetings Desktop App for Mac. The application fails to properly validate the cryptographic protections on files downloaded during a software update, allowing an attacker to supply malicious files that are executed as part of the update process. Affected versions include all releases prior to the fixed version provided in the Cisco advisory [1].

Exploitation

An unauthenticated, remote attacker can exploit this vulnerability by persuading a user to visit a malicious website that returns files similar to those from a valid Webex website. The attacker hosts a website that mimics the Webex update response; when the user visits the site, the Webex client downloads the malicious files and, due to the lack of cryptographic validation, executes them as part of a software update. No authentication or prior access is required, only user interaction to visit the malicious site.

Impact

Successful exploitation allows the attacker to execute arbitrary code on the affected system with the privileges of the user running the Webex Meetings Desktop App. This can lead to full compromise of the user's system, including data theft, installation of malware, and further lateral movement within the network.

Mitigation

Cisco has released free software updates that address this vulnerability. Users should upgrade to the latest version of Cisco Webex Meetings Desktop App for Mac as specified in the Cisco Security Advisory [1]. No workarounds are available. Customers can obtain the fixed software through the Cisco TAC or their usual support channels as described in the advisory [1].