Cisco Webex vulnerability allows hackers to take control of your network
Vulnerability testing specialists report the presence of a critical security flaw in some Cisco products, including Webex, the popular video conferencing platform. If exploited, the vulnerability could allow a remote hacker to execute commands on the target system.
The vulnerability was detected in the Webex
Video Mash web management interface, a feature that allows audio and video improving
during a videoconference. In the report, the researchers mention that
exploiting this flaw allows arbitrary command execution on the underlying Linux
system with root user privileges.
The report indicates that the flaw can be
exploited remotely; however, vulnerability testing experts mention that threat
actors exploiting this flaw must first be authenticated on the system. Besides,
before carrying out the attack they would require logging in to the web
interface of the affected system and send requests specifically designed for
exploitation.
The flaw exists because the Webex Video Mash web
interface does not correctly validate requests sent by the attacker, which
ultimately allows arbitrary commands execution. The vulnerability affects all
versions of this software prior to 2019.03.19.1956m. In addition, the flaw
received a score of 7.2/10 on the Common Vulnerability Scoring System (CVSS)
scale, so it is considered a high severity flaw.
The main risk that exploiting this flaw would
bring is the possibility of launching cross-site request forgery (XSRF)
attacks, vulnerability testing experts mention. It should be noted that these
attacks also depend on the launch of a social engineering campaign to trick
victims into having them visit websites operated by hackers and designed to
send forged requests.
The flaw was discovered by vulnerability testing
specialist Mehmet’nder Key and affects Cisco devices running vulnerable
versions of Cisco IOS or Cisco IOS XE Software earlier than 16.1.1 with HTTP
Server enabled. Shortly after receiving the vulnerability report, Cisco
acknowledged its existence and announced the release of a security update. In
addition, the company states that so far there are no known cases of
exploitation in real-world scenarios.
According to the International Institute of
Cyber Security (IICS), Cisco issued a total of 14 updates to correct multiple bugs
in its products, most of them average severity. Almost every report is related
to authentication bypass, privilege escalation on specific systems, among other
security issues.
He is a well-known expert in mobile security and malware analysis. He studied Computer Science at NYU and started working as a cyber security analyst in 2003. He is actively working as an anti-malware expert. He also worked for security companies like Kaspersky Lab. His everyday job includes researching about new malware and cyber security incidents. Also he has deep level of knowledge in mobile security and mobile vulnerabilities.
Gloss