PT-2019-1518 · Cisco · Cisco Webex Meetings Desktop App+1

Marcos Accossatto · Published 2019-01-27 · Updated 2019-10-09 · CVE-2019-1674

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco Webex Meetings Desktop App versions prior to 33.6.6 and 33.9.1 Cisco Webex Productivity Tools versions prior to 33.0.7

Description A vulnerability in the update service could allow an authenticated, local attacker to execute arbitrary commands as a privileged user due to insufficient validation of user-supplied parameters. An attacker could exploit this by invoking the update service command with a crafted argument, potentially running arbitrary commands with SYSTEM user privileges. In Active Directory deployments, the vulnerability could be exploited remotely by leveraging the operating system remote management tools.

Recommendations For Cisco Webex Meetings Desktop App versions prior to 33.6.6 and 33.9.1, update to Release 33.6.6 or 33.9.1. For Cisco Webex Productivity Tools versions prior to 33.0.7, update to Release 33.0.7. As a temporary workaround, consider restricting access to the update service command until a patch is applied.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2019-00980

CVE-2019-1674

Affected Products

Cisco Webex Meetings Desktop App

Cisco Webex Productivity Tools

References · 7

• 🔥 https://exploit-db.com/exploits/46479 · Exploit
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190227-wmda-cmdinj · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-1674 · Security Note
• https://osv.dev/vulnerability/CVE-2019-1674 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-00980 · Security Note
• https://securityfocus.com/bid/107184 · Note
• http://securityfocus.com/bid/107184 · Note