Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2018-15442 — OS Command Injection in Cisco Webex Meetings Desktop

CWE-78 — OS Command Injection6 documents5 sources
Severity
7.8HIGHNVD
EPSS
43.3%
top 2.49%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
3
Cisco Webex Meetings DesktopCisco Webex Productivity ToolsCisco Webex Event Center
Timeline
PublishedOct 24
Latest updateMay 13

Description

A vulnerability in the update service of Cisco Webex Meetings Desktop App for Windows could allow an authenticated, local attacker to execute arbitrary commands as a privileged user. The vulnerability is due to insufficient validation of user-supplied parameters. An attacker could exploit this vulnerability by invoking the update service command with a crafted argument. An exploit could allow the attacker to run arbitrary commands with SYSTEM user privileges. While the CVSS Attack Vector metric …

CVSS vector

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages3 packages

▶NVDcisco/webex_productivity_tools32.6.0 — 33.0.6

🔴Vulnerability Details

2
GHSA
GHSA-766m-hqm4-2gcf: A vulnerability in the update service of Cisco Webex Meetings Desktop App for Windows could allow an authenticated, local attacker to execute arbitrar↗2022-05-13
▶
CVEList
Cisco Webex Meetings Desktop App Update Service Command Injection Vulnerability↗2018-10-24
▶

💥Exploits & PoCs

2
Exploit-DB
WebEx - Local Service Permissions Exploit (Metasploit)↗2018-10-25
▶
Exploit-DB
WebExec - (Authenticated) User Code Execution (Metasploit)↗2018-10-25
▶

📋Vendor Advisories

1
Cisco
Cisco Webex Meetings Desktop App Update Service Command Injection Vulnerability↗2018-10-24
▶
CVE-2018-15442 — OS Command Injection in Cisco | cvebase