Cisco Webex App Custom URL Parser Remote Code Execution Vulnerability

A remote code execution vulnerability has been identified in Cisco Webex App, stemming from inadequate input validation in the custom URL parser. This issue allows an unauthenticated, remote attacker to convince a user to download arbitrary files, which could then be used to execute commands on the user's host. The vulnerability arises when the application processes a crafted meeting invite link.

Impact

Exploitation of this vulnerability could lead to unauthorized remote code execution on the affected user's device, with the executed commands running under the user's privileges.

Remediation

Cisco has released software updates to address this vulnerability. Users can obtain these updates through their usual channels. For specific upgrade instructions, refer to the Cisco Security Vulnerability Policy.