Cisco Patches Flaw in Webex Videoconferencing App

By Jai Vijayan for Dark Reading
Thursday, June 18, 2020

• 1.6k
• More

Cisco itself rated the vulnerability as being only of medium severity, likely because an attacker would already need to be on a system in order to exploit it. Ilia Kolochenko, founder and CEO of ImmuniWeb, says that fact alone would have severely limited the practical exploitation of flaw. A creative attacker that already had free access to a system would likely not have needed to exploit the Webex flaws to get at the information, he says.

Even so, the flaw represents a failure by the Webex team to follow fundamental software development best practices. "Users that share their machines with third parties should install the available security update without delay," Kolochenko says.

Karl Sigler, senior security research manager at Trustwave's SpiderLabs, says an attacker would not necessarily need to be logged in to a machine directly to take advantage of the Webex flaw. "They could craft malware that when implanted on the victim's system could constantly monitor for Webex tokens," he says. "That would give the attacker access to upcoming meetings, past meetings, and any existing meeting recordings. All of this could leak confidential information to an attacker." Read Full Article