Vulnerability Details : CVE-2019-1674
Potential exploit
A vulnerability in the update service of Cisco Webex Meetings Desktop App and Cisco Webex Productivity Tools for Windows could allow an authenticated, local attacker to execute arbitrary commands as a privileged user. The vulnerability is due to insufficient validation of user-supplied parameters. An attacker could exploit this vulnerability by invoking the update service command with a crafted argument. An exploit could allow the attacker to run arbitrary commands with SYSTEM user privileges. While the CVSS Attack Vector metric denotes the requirement for an attacker to have local access, administrators should be aware that in Active Directory deployments, the vulnerability could be exploited remotely by leveraging the operating system remote management tools. This vulnerability is fixed in Cisco Webex Meetings Desktop App Release 33.6.6 and 33.9.1 releases. This vulnerability is fixed in Cisco Webex Productivity Tools Release 33.0.7.
Products affected by CVE-2019-1674
- cpe:2.3:a:cisco:webex_meetings:*:*:*:*:desktop:*:*:*
- cpe:2.3:a:cisco:webex_productivity_tools:*:*:*:*:*:*:*:*
- cpe:2.3:a:cisco:webex_meetings_online:t33.6.0:*:*:*:*:*:*:*
- cpe:2.3:a:cisco:webex_meetings_online:t33.6.2:*:*:*:*:*:*:*
- cpe:2.3:a:cisco:webex_meetings_online:t33.0.5:*:*:*:*:*:*:*
- cpe:2.3:a:cisco:webex_meetings_online:t33.6.1:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2019-1674
36.42%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 97 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2019-1674
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
9.0
|
HIGH | AV:N/AC:L/Au:S/C:C/I:C/A:C |
8.0
|
10.0
|
NIST | |
|
8.8
|
HIGH | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
2.8
|
5.9
|
NIST | |
|
7.8
|
HIGH | CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
1.8
|
5.9
|
Cisco Systems, Inc. |
CWE ids for CVE-2019-1674
-
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.Assigned by:
- nvd@nist.gov (Primary)
- ykramarz@cisco.com (Secondary)
References for CVE-2019-1674
-
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190227-wmda-cmdinj
Cisco Webex Meetings Desktop App and Cisco Webex Productivity Tools Update Service Command Injection VulnerabilityVendor Advisory
-
https://www.exploit-db.com/exploits/46479/
Cisco WebEx Meetings < 33.6.6 / < 33.9.1 - Privilege EscalationExploit;Third Party Advisory
-
http://www.securityfocus.com/bid/107184
Multiple Cisco Products CVE-2019-1674 Local Command Injection VulnerabilityThird Party Advisory
Jump to