CVE-2018-15442 Cisco Webex Meetings Desktop App Update Service Command Injection Vulnerability

High 7.8 Published 24 Oct 2018 Updated 26 Nov 2024

Local attackers can execute arbitrary commands with SYSTEM privileges via the update service, potentially escalating privileges in Active Directory environments.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2018-15442?

CVE-2018-15442 is a high-severity command injection vulnerability in Cisco WebEx Event Center, published on 24 Oct 2018. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

A vulnerability in the update service of Cisco Webex Meetings Desktop App for Windows could allow an authenticated, local attacker to execute arbitrary commands as a privileged user. The vulnerability is due to insufficient validation of user-supplied parameters. An attacker could exploit this vulnerability by invoking the update service command with a crafted argument. An exploit could allow the attacker to run arbitrary commands with SYSTEM user privileges. While the CVSS Attack Vector metric denotes the requirement for an attacker to have local access, administrators should be aware that in Active Directory deployments, the vulnerability could be exploited remotely by leveraging the operating system remote management tools.

Weakness: CWE-78

Which versions are affected by CVE-2018-15442?

It affects 2 products.

Products include Cisco Webex Meetings Desktop, Cisco Webex Productivity Tools.

How do I fix CVE-2018-15442?

No fix has been published for CVE-2018-15442 yet. Limit exposure of the affected software until one is available.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2018-15442 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2018-15442 exists.

Public exploit code: 3 Metasploit modules and 4 Exploit-DB entries.

Sources

Also known as GHSA-766m-hqm4-2gcf.