// For flags

CVE-2020-3588

Cisco Webex Meetings Desktop App Arbitrary Code Execution Vulnerability

Severity Score

7.8
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

A vulnerability in virtualization channel messaging in Cisco Webex Meetings Desktop App for Windows could allow a local attacker to execute arbitrary code on a targeted system. This vulnerability occurs when this app is deployed in a virtual desktop environment and using virtual environment optimization. This vulnerability is due to improper validation of messages processed by the Cisco Webex Meetings Desktop App. A local attacker with limited privileges could exploit this vulnerability by sending malicious messages to the affected software by using the virtualization channel interface. A successful exploit could allow the attacker to modify the underlying operating system configuration, which could allow the attacker to execute arbitrary code with the privileges of a targeted user. Note: This vulnerability can be exploited only when Cisco Webex Meetings Desktop App is in a virtual desktop environment on a hosted virtual desktop (HVD) and is configured to use the Cisco Webex Meetings virtual desktop plug-in for thin clients.

Una vulnerabilidad en la mensajería del canal de virtualización en Cisco Webex Meetings Desktop App para Windows, podría permitir a un atacante local ejecutar código arbitrario en un sistema de destino. Esta vulnerabilidad ocurre cuando esta aplicación es implementada en un entorno de escritorio virtual y se utiliza la optimización del entorno virtual.  Esta vulnerabilidad es debido a una comprobación inapropiada de los mensajes procesados ??por Cisco Webex Meetings Desktop App. Un atacante local con privilegios limitados podría explotar esta vulnerabilidad mediante el envío mensajes maliciosos al software afectado mediante la interfaz del canal de virtualización. Una explotación con éxito podría permitir al atacante modificar la configuración del sistema operativo subyacente, lo que podría permitir al atacante ejecutar código arbitrario con los privilegios de un usuario apuntado. Nota: Esta vulnerabilidad puede ser explotada solo cuando Cisco Webex Meetings Desktop App se encuentra en un entorno de escritorio virtual en un hosted virtual desktop (HVD) y está configurado para usar el plug-in virtual desktop de Webex Meetings para clientes ligeros

*Credits: N/A
CVSS Scores
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Local
Attack Complexity
Low
Authentication
None
Confidentiality
Partial
Integrity
Partial
Availability
Partial
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2019-12-12 CVE Reserved
  • 2020-11-06 CVE Published
  • 2023-03-08 EPSS Updated
  • 2024-09-17 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Cisco
Search vendor "Cisco"
 Webex Meetings
Search vendor "Cisco" for product "Webex Meetings"
 < 40.6.9
Search vendor "Cisco" for product "Webex Meetings" and version " < 40.6.9"
windows
Affected
Cisco
Search vendor "Cisco"
 Webex Meetings
Search vendor "Cisco" for product "Webex Meetings"
 >= 40.8.0 < 40.8.9
Search vendor "Cisco" for product "Webex Meetings" and version " >= 40.8.0 < 40.8.9"
windows
Affected