A vulnerability in the update service of Cisco Webex Meetings Desktop App for Windows could allow an authenticated, local attacker to execute arbitrary commands as a privileged user. The vulnerability is due to insufficient validation of user-supplied parameters. An attacker could exploit this vulnerability by invoking the update service command with a crafted argument. An exploit could allow the attacker to run arbitrary commands with SYSTEM user privileges. While the CVSS Attack Vector metric denotes the requirement for an attacker to have local access, administrators should be aware that in Active Directory deployments, the vulnerability could be exploited remotely by leveraging the operating system remote management tools.
History

Tue, 26 Nov 2024 15:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}


cve-icon MITRE

Status: PUBLISHED

Assigner: cisco

Published: 2018-10-24T19:00:00Z

Updated: 2024-11-26T14:23:20.110Z

Reserved: 2018-08-17T00:00:00

Link: CVE-2018-15442

cve-icon Vulnrichment

Updated: 2024-08-05T09:54:03.532Z

cve-icon NVD

Status : Modified

Published: 2018-10-24T19:29:00.290

Modified: 2024-11-21T03:50:48.723

Link: CVE-2018-15442

cve-icon Redhat

No data.