$ cve CVE-2019-1674 JSON

CVE-2019-1674 EXPLOIT

7.8

HIGH · CVSS 3.0 · EPSS 9.8% (pctl 95)

Patch early

A public exploit exists.

Description

A vulnerability in the update service of Cisco Webex Meetings Desktop App and Cisco Webex Productivity Tools for Windows could allow an authenticated, local attacker to execute arbitrary commands as a privileged user. The vulnerability is due to insufficient validation of user-supplied parameters. An attacker could exploit this vulnerability by invoking the update service command with a crafted argument. An exploit could allow the attacker to run arbitrary commands with SYSTEM user privileges. While the CVSS Attack Vector metric denotes the requirement for an attacker to have local access, administrators should be aware that in Active Directory deployments, the vulnerability could be exploited remotely by leveraging the operating system remote management tools. This vulnerability is fixed in Cisco Webex Meetings Desktop App Release 33.6.6 and 33.9.1 releases. This vulnerability is fixed in Cisco Webex Productivity Tools Release 33.0.7.

Scoring

CVSS	7.8 (HIGH, v3.0)
Vector	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS	9.81% — more likely to be exploited than 95% of all CVEs
Weakness	CWE-78
On CISA KEV	no
Public exploit	yes
Published	2019-02-28
Last modified	2026-06-17

Affected (4)

Vendor	Product
cisco	webex meetings
cisco	webex meetings online
cisco	webex productivity tools
microsoft	windows

Public exploits

Source	Title	Date
exploit-db	Cisco WebEx Meetings < 33.6.6 / < 33.9.1 - Privilege Escalation	2019-03-01

References

→ the Explorer · watch your stack · NVD