CVE-2021-1527: 
Cisco WebEx Player vulnerability analysis and mitigation

A vulnerability (CVE-2021-1527) was discovered in Cisco Webex Player for Windows and MacOS. The vulnerability, disclosed on June 2, 2021, affects versions earlier than Release 41.5. It stems from insufficient validation of values in Webex recording files stored in Webex Recording Format (WRF) (Cisco Advisory).

The vulnerability is characterized by insufficient validation of values in Webex recording files that are stored in Webex Recording Format (WRF). It received a CVSS v3.1 base score of 5.3 MEDIUM (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L) from Cisco, while NIST assigned it a score of 6.1 MEDIUM (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H). The vulnerability is classified under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) (Cisco Advisory, NVD).

A successful exploitation of this vulnerability could allow an attacker to crash the affected software and gain access to memory state information related to the vulnerable application (Cisco Advisory).

The vulnerability requires user interaction to exploit. An attacker could exploit this vulnerability by sending a malicious WRF file to a user as a link or email attachment and then persuading the user to open the file with the affected software on the local system. The Cisco Product Security Incident Response Team (PSIRT) reported no known public announcements or malicious use of this vulnerability at the time of disclosure (Cisco Advisory).

Cisco has released software updates that address this vulnerability in Webex Player releases 41.5 and later. No workarounds are available for this vulnerability. Users are advised to upgrade to the fixed version available from the Cisco Webex Video Recording page or corresponding Cisco Webex Meetings sites (Cisco Advisory).