PT-2021-2350 · Cisco · Cisco Jabber For Windows+2

Published 2021-03-24 · Updated 2022-10-21 · CVE-2021-1469

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cisco Jabber for Windows (affected versions not specified) Cisco Jabber for MacOS (affected versions not specified) Cisco Jabber for mobile platforms (affected versions not specified)

Description The issue allows an attacker to execute arbitrary programs on the underlying operating system with elevated privileges, access sensitive information, intercept protected network traffic, or cause a denial of service (DoS) condition. The vulnerability is related to insufficient input validation, which could allow a remote attacker to run programs on the target system with elevated privileges or execute arbitrary code.

Recommendations For Cisco Jabber for Windows, consider disabling the vulnerable functionality until a patch is available. For Cisco Jabber for MacOS, restrict access to sensitive information to minimize the risk of exploitation. For Cisco Jabber for mobile platforms, avoid using the platform until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Code Injection

RCE

Weakness Enumeration

CWE-94

CWE-20

CWE-170

Related Identifiers

BDU:2021-01588

CVE-2021-1469

Affected Products

Cisco Jabber For Macos

Cisco Jabber For Windows

Cisco Jabber For Mobile Platforms

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2021-1469 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cisco-jabber-PWrTATTC · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-01588 · Security Note
• https://osv.dev/vulnerability/CVE-2021-1469 · Vendor Advisory