Cisco Webex Network Recording Player and Cisco Webex Player Arbitrary Code Execution Vulnerabilities

Vulnerability

Multiple vulnerabilities in Cisco Webex Network Recording Player for Windows and Cisco Webex Player for Windows, identified as CVE-2020-3573, allow an attacker to execute arbitrary code on an affected system. The issue resides in the parsing of Advanced Recording Format (ARF) and Webex Recording Format (WRF) files. The software fails to properly initialize a pointer before accessing it during file parsing [1]. Affected versions include all releases prior to the fixed versions outlined in the Cisco security advisory [2]. User interaction is required to trigger the flaw.

Exploitation

An attacker can exploit this vulnerability by crafting a malicious ARF or WRF file and delivering it to a target via a link or email attachment. The victim must open the malicious file using the affected Cisco Webex Network Recording Player or Webex Player on a Windows system [1]. No authentication or special network position is needed beyond the ability to deliver the file to the user. The flaw is triggered during the parsing process when an uninitialized pointer is dereferenced [1].

Impact

Successful exploitation allows the attacker to execute arbitrary code on the target system with the privileges of the user running the player [1]. This can lead to full compromise of the affected host, including confidentiality, integrity, and availability impacts [1]. The CVSS score is 7.8 (High) under AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H [1].

Mitigation

Cisco released free software updates to address the vulnerability. Users are advised to upgrade to the fixed versions listed in the Cisco security advisory [2]. No workarounds are documented. Customers should contact Cisco TAC if they cannot obtain the update through standard channels [2].