Cisco Webex Meetings Desktop App Arbitrary Code Execution Vulnerability

Vulnerability

The vulnerability exists in the Cisco Webex Meetings Desktop App for Windows when deployed in a virtual desktop environment with virtual environment optimization enabled. The improper validation of messages processed via the virtualization channel interface allows a local attacker to exploit this flaw. Affected versions are those prior to the fixed release mentioned in the Cisco advisory [1] (Cisco Webex Meetings Desktop App releases before the November 2020 update). The vulnerability is specific to configurations using Cisco Webex Meetings virtual desktop plug-in for thin clients on a hosted virtual desktop (HVD) [1].

Exploitation

A local attacker with limited privileges on the virtual desktop can send specially crafted messages to the affected software through the virtualization channel interface. The attacker does not require network or remote access; local access to the HVD environment is sufficient. The attack requires the targeted software to be running and configured with the virtual desktop plug-in [1]. The sequence involves the attacker writing malicious virtualization channel messages that the Cisco Webex Meetings Desktop App fails to validate properly.

Impact

Successful exploitation allows the attacker to modify the underlying operating system configuration, which can lead to arbitrary code execution with the privileges of a targeted user. This results in potential full compromise of the user session on the HVD, including information disclosure, data modification, and execution of additional malicious code [1].

Mitigation

Cisco has released free software updates to address this vulnerability. Customers should upgrade to the fixed version as provided in the advisory [1]. No workarounds are available. The vulnerability is not known to be in the KEV catalog as of the publication date. Customers without service contracts should contact Cisco TAC for upgrade assistance [1].