High severity · published Jun 4, 2021
CVE-2021-1503
Cisco Webex Network Recording Player and Webex Player Memory Corruption Vulnerability
7.8
CVSS
1%
EPSS
No
On KEV
Description
A vulnerability in Cisco Webex Network Recording Player for Windows and MacOS and Cisco Webex Player for Windows and MacOS could allow an attacker to execute arbitrary code on an affected system. This vulnerability is due to insufficient validation of values in Webex recording files that are in either Advanced Recording Format (ARF) or Webex Recording Format (WRF). An attacker could exploit this vulnerability by sending a user a malicious ARF or WRF file through a link or email attachment and persuading the user to open the file with the affected software on the local system. A successful exploit could allow the attacker to execute arbitrary code on the affected system with the privileges of the targeted user.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 63% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CW
Cisco Webex Meetings · Cisco
All versions, or not specified · source: vendor
WM
WP
Webex Player · Cisco
before 41.2; before 41.2 · source: NVD
Affected product
CW
Cisco Webex Meetings
Cisco
More from Cisco Webex Meetings
9.8
CVE-2026-20184
Cisco Webex Meetings Certificate Validation Vulnerability
8.8
CVE-2022-20763
Cisco Webex Meetings Java Deserialization Vulnerability
7.8
CVE-2021-1526
Cisco Webex Player Memory Corruption Vulnerability
7.8
CVE-2021-1502
Cisco Webex Network Recording Player and Webex Player Memory Corruption Vulnerability
7.1
CVE-2021-34743
Cisco Webex Software Application Authorization Bypass Vulnerability