Cisco Webex Meetings Desktop App for Windows Arbitrary File Overwrite Vulnerability

Vulnerability

The vulnerability exists in Cisco Webex Meetings Desktop App for Windows due to improper validation of URL parameters sent from a website to the application. An attacker can craft a malicious website that submits specially crafted input to the affected application. Affected versions include those prior to 40.6.9 and 40.8. [1]

Exploitation

An attacker must persuade a user to follow a URL to a malicious website designed to submit crafted input to the Cisco Webex Meetings Desktop App. No authentication is required, and the attack is remote. The user interaction is required (clicking a link). [1]

Impact

Successful exploitation allows the attacker to overwrite arbitrary files on the end-user's system, potentially corrupting or deleting critical system files, leading to system instability or denial of service. [1]

Mitigation

Cisco has released fixed versions: Cisco Webex Meetings Desktop App for Windows releases 40.6.9 and later and 40.8 and later. Administrators can update via mass deployment instructions. Users can update manually. No workarounds are mentioned. [1]