High severity · published Jun 4, 2021
CVE-2021-1502
A vulnerability in Cisco Webex Network Recording Player for Windows and MacOS and Cisco Webex Player for Windows and MacOS could allow an attacker to execute arbitrary code on an…
7.8
CVSS
1.1%
EPSS
No
On KEV
Description
A vulnerability in Cisco Webex Network Recording Player for Windows and MacOS and Cisco Webex Player for Windows and MacOS could allow an attacker to execute arbitrary code on an affected system. The vulnerability is due to insufficient validation of values within Webex recording files formatted as either Advanced Recording Format (ARF) or Webex Recording Format (WRF). An attacker could exploit the vulnerability by sending a user a malicious ARF or WRF file through a link or email attachment and persuading the user to open the file. A successful exploit could allow the attacker to execute arbitrary code on the affected system with the privileges of the targeted user.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 65% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WM
Webex Meetings Desktop · Cisco
All versions, or not specified · source: NVD
WM
Webex Meetings Online · Cisco
All versions, or not specified · source: NVD
WM
Webex Meetings Server · Cisco
4.0 · source: NVD
WN
Webex Network Recording Player · Cisco
before 41.5; before 41.5 · source: NVD
WT
Webex Teams · Cisco
3.0.15485.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-1502
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-1502
Vendor Advisory
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-player-dOJ2jOJ
More from Webex Meetings Desktop
7.8
CVE-2021-1536
A vulnerability in Cisco Webex Meetings Desktop App for Windows, Cisco Webex Meetings Server, Cisco Webex Network Recording Player for Windows, and Cisco Webex Teams for Windows…
7.8
CVE-2018-15442
A vulnerability in the update service of Cisco Webex Meetings Desktop App for Windows could allow an authenticated, local attacker to execute arbitrary commands as a privileged…
