CVE-2020-3573 : Security Advisory and Response

Cisco Webex Network Recording Player and Cisco Webex Player Arbitrary Code Execution Vulnerabilities

Understanding CVE-2020-3573

Multiple vulnerabilities in Cisco Webex Network Recording Player for Windows and Cisco Webex Player for Windows could allow an attacker to execute arbitrary code on an affected system.

What is CVE-2020-3573?

The vulnerabilities in Cisco Webex Network Recording Player and Cisco Webex Player for Windows stem from insufficient validation of certain elements in Webex recordings stored in ARF or WRF formats. Attackers can exploit these vulnerabilities by tricking users into opening malicious files, leading to arbitrary code execution.

The Impact of CVE-2020-3573

The vulnerabilities have a CVSS base score of 7.8, indicating a high severity level. They could result in an attacker executing arbitrary code on affected systems with high confidentiality, integrity, and availability impacts.

Technical Details of CVE-2020-3573

Vulnerability Description

The vulnerabilities allow attackers to execute arbitrary code on affected systems by exploiting insufficient validation of Webex recording elements stored in ARF or WRF formats.

Affected Systems and Versions

Product: Cisco Webex Network Recording Player
Vendor: Cisco
Versions affected: n/a

Exploitation Mechanism

Attackers can exploit these vulnerabilities by sending users malicious ARF or WRF files through links or email attachments, persuading them to open the files with the affected software on their local systems.

Mitigation and Prevention

Immediate Steps to Take

Update Cisco Webex Network Recording Player and Cisco Webex Player to the latest versions.
Avoid opening files from untrusted sources or suspicious links.
Educate users on recognizing phishing attempts and malicious files.

Long-Term Security Practices

Regularly update software and security patches.
Implement email filtering to block suspicious attachments.
Conduct security awareness training for employees.

Patching and Updates

Apply patches and updates provided by Cisco to address the vulnerabilities in Cisco Webex Network Recording Player and Cisco Webex Player.