Cisco Webex Network Recording Player and Webex Player Memory Corruption Vulnerability

Vulnerability

A memory corruption vulnerability in Cisco Webex Network Recording Player and Cisco Webex Player for Windows and macOS arises due to insufficient validation of values within Webex recording files formatted as either Advanced Recording Format (ARF) or Webex Recording Format (WRF). Affected versions of Webex Network Recording Player prior to version 41.1.0.0 and Webex Player prior to version 41.1.0.0 are vulnerable. The code path is reachable when a user opens a maliciously crafted ARF or WRF file [1].

Exploitation

An unauthenticated remote attacker can exploit this vulnerability by sending a user a malicious ARF or WRF file through a link or email attachment and persuading the user to open the file. No authentication or special network position is required; the attacker relies on social engineering to convince the target to open the crafted file [1].

Impact

Successful exploitation allows the attacker to execute arbitrary code on the affected system with the privileges of the targeted user. This can lead to full compromise of the user's session, data theft, installation of malware, or further lateral movement within the network depending on the user's access level [1].

Mitigation

Cisco has released fixed software versions: Webex Network Recording Player and Webex Player version 41.1.0.0 or later. Customers should upgrade to the latest versions as provided by Cisco. No workarounds are available; the fix must be applied via the official software update channels [1].