Cisco Webex Network Recording Player and Cisco Webex Player Arbitrary Code Execution Vulnerabilities

Description

Multiple vulnerabilities in Cisco Webex Network Recording Player for Microsoft Windows and Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerabilities exist because the affected software improperly validates Advanced Recording Format (ARF) and Webex Recording Format (WRF) files. An attacker could exploit these vulnerabilities by sending a user a malicious ARF or WRF file through a link or email attachment and persuading the user to open the file with the affected software on the local system. A successful exploit could allow the attacker to execute arbitrary code on the affected system with the privileges of the targeted user.

Scores

EPSS (exploitation in 30 days)

1.5% · top 27% of all CVEs (2 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: no · Technical impact: total

Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.8.

Weakness

• CWE-119 (opens in a new tab)

Affected products

• Cisco · Cisco WebEx WRF Player

  • affected unspecified – < 39.5.5

What to do

Exploitation: The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory.

References (1)

• 20190807 Cisco Webex Network Recording Player and Cisco Webex Player Arbitrary Code Execution Vulnerabilities (opens in a new tab)vendor-advisoryx_refsource_CISCOx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Record last updated 20 Nov 2024, 17:14 UTC.