Cisco security team has released updates to fix two critical flaws in the Webex desktop application for Windows and macOS systems. According to the report of cloud security course specialists, exploiting these flaws would allow hackers to run code and malware on exposed computers.
It should be remembered that Webex is a videoconferencing platform with multiple useful functions during this period of confinement due to the pandemic, so the use of this kind of tools has increased over the last few months.
Vulnerabilities, tracked as CVE-2020-3263 and CVE-2020-3342, reside in all versions of Cisco Webex for desktops prior to v39.5.12. One of the flaws is an arbitrary software execution issue that affects the Windows client, and is caused by incorrect input validation of URLs sent to affected versions of Cisco for Windows.
Cloud security course specialists mention that “CVE-2020-3263 would allow unauthenticated hackers to run programs on systems that use vulnerable versions of Webex; users could be tricked into clicking on a malicious URL for subsequent attacks.”
On the other hand, the remote code execution vulnerability found on the macOS client is due to incorrect certificate validation in the update files for affected Webex versions. “CVE-2020-3342 could allow unauthenticated threat actors to execute remote arbitrary code with user privileges who logged on to Apple computers running unfixed versions of Cisco Webex for Mac,” the researchers mention.
Hackers can exploit this flaw by tricking Webex users into redirecting them to sites loaded with malicious content, completely compromising the vulnerable system.
Alternative solutions to mitigate the risk of exploitation are not known for now, so cloud security course experts strongly recommend Webex users upgrade their deployments. The flaws were released by the Cisco Product Security Incident Response Team (PSIRT), which ensures that no attempts to exploit these failures have been detected in real-world scenarios.
The Cisco video conferencing platform has received multiple updates recently; most of the time these are flaws that would allow remote code to run on vulnerable versions of Webex, although there are very few occasions when the company has detected active exploitation of some flaw.
For further reports on vulnerabilities, exploits, malware variants and computer security risks, it is recommended to enter the website of the International Institute of Cyber Security (IICS), as well as the official platforms of technology companies.
He is a well-known expert in mobile security and malware analysis. He studied Computer Science at NYU and started working as a cyber security analyst in 2003. He is actively working as an anti-malware expert. He also worked for security companies like Kaspersky Lab. His everyday job includes researching about new malware and cyber security incidents. Also he has deep level of knowledge in mobile security and mobile vulnerabilities.
