Rewterz penetration testing services help organizations determine if a cyber attacker can gain access to their critical assets while giving them detailed insights of the overall business impact of a cyber attack.
Before Rewterz got its start, the market was in dire need of a specialized and dedicated information security company. It was nearly impossible for businesses to find a trustworthy provider that could truly cover all of their bases. We wanted to meet this need, giving companies across the globe a chance to get ahead while knowing that their data is in good hands.
Rewterz penetration testing services help organizations determine if a cyber attacker can gain access to their critical assets while giving them detailed insights of the overall business impact of a cyber attack.
Before Rewterz got its start, the market was in dire need of a specialized and dedicated information security company. It was nearly impossible for businesses to find a trustworthy provider that could truly cover all of their bases. We wanted to meet this need, giving companies across the globe a chance to get ahead while knowing that their data is in good hands.
Severity: Medium
Analysis Summary
The vulnerability is an OS Command Injection described it as a “bypass to avoid the new controls” put in place by Cisco after patching a previously found a DLL hijacking issue in the same application.
The vulnerability stems from the inability of the Cisco Webex Meetings Desktop App’s update service to properly validate version numbers of new files. So, an unprivileged local attacker could exploit this vulnerability by invoking the update service command with a crafted argument and folder.
A potential attacker could exploit this software flaw by replacing the Cisco Webex Meetings update binary with a “previous vulnerable version through a fake update (the service uses an XML to check which files can be installed) that will load a malicious DLL,” leading to privilege escalation and allowing the actor to run arbitrary commands with SYSTEM user privileges.
Impact
Affected Products
All versions of Cisco WebEx Meetings Desktop App releases between 33.6.4.15 and 33.8.2.7
Remediation
This vulnerability can be exploited remotely by leveraging the operating system and remote management tools, so the administrators should be aware of the active directory deployments.