CVE-2020-3263: 
Cisco Webex Meetings vulnerability analysis and mitigation

A vulnerability (CVE-2020-3263) was discovered in Cisco Webex Meetings Desktop App that could allow an unauthenticated, remote attacker to execute programs on affected end-user systems. The vulnerability was disclosed on June 17, 2020, and affects Cisco Webex Meetings Desktop App releases earlier than Release 39.5.12 (NVD, Bleeping Computer).

The vulnerability is caused by improper validation of input that is supplied to application URLs. It received a CVSS score of 7.5 out of 10, indicating a high severity level. The vulnerability specifically affects the URL handling mechanism in the Webex Meetings Desktop App (Threatpost, Help Net Security).

If successfully exploited, the vulnerability could allow an attacker to cause the application to execute other programs that are already present on the end-user system. If malicious files are planted on the system or on an accessible network file path, the attacker could execute arbitrary code on the affected system (Bleeping Computer).

An attacker could exploit this vulnerability by persuading a user to follow a malicious URL. The attack requires user interaction and the presence of specific conditions to be successful. No known public exploits were available at the time of disclosure (Bleeping Computer).

Cisco has released software updates to address this vulnerability. The fix is available in Cisco Webex Meetings Desktop App releases 40.1.0 and later. Users can update the Cisco Webex Meetings Desktop App using the instructions in the Update help center article, while administrators can perform mass deployment using the IT Administrator Guide (Bleeping Computer).