Memory corruption in Cisco WebEx Network Recording Player
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- No fix listed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-119 and the CVSS impact.
Summary
A Buffer Overflow vulnerability in Cisco WebEx Network Recording Player for Advanced Recording Format (.arf) files could allow an attacker to execute arbitrary code on a system. An attacker could exploit this vulnerability by providing a user with a malicious .arf file via email or URL and convincing the user to launch the file. Exploitation of this vulnerability could allow arbitrary code execution on the system of the targeted user. This vulnerability affects Cisco WebEx Business Suite meeting sites, Cisco WebEx Meetings sites, Cisco WebEx Meetings Server, and Cisco WebEx ARF players. Cisco Bug IDs: CSCve10729, CSCve10771, CSCve10779, CSCve11521, CSCve11543.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | Cisco WebEx Network Recording Player | Cisco WebEx Network Recording Player | — | No fix listed | CNA |
- Cisco WebEx Network Recording Player Vendor— Affected Cisco WebEx Network Recording Player Fixed in — No fix listed CNA
CPE configurations NVD · 6
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:cisco:webex_meeting_center:t29:*:*:*:*:*:*:* | t29 | Vulnerable | Cisco |
| cpe:2.3:a:cisco:webex_meeting_center:t30:*:*:*:*:*:*:* | t30 | Vulnerable | Cisco |
| cpe:2.3:a:cisco:webex_meeting_center:t31:*:*:*:*:*:*:* | t31 | Vulnerable | Cisco |
| cpe:2.3:a:cisco:webex_meeting_center:t32:*:*:*:*:*:*:* | t32 | Vulnerable | Cisco |
| cpe:2.3:a:cisco:webex_meetings_server:2.6.0:*:*:*:*:*:*:* | 2.6.0 | Vulnerable | Cisco |
| cpe:2.3:a:cisco:webex_meetings_server:2.7.0:*:*:*:*:*:*:* | 2.7.0 | Vulnerable | Cisco |
- cpe:2.3:a:cisco:webex_meeting_center:t29:*:*:*:*:*:*:* Versions t29 Vulnerable ·Cisco
- cpe:2.3:a:cisco:webex_meeting_center:t30:*:*:*:*:*:*:* Versions t30 Vulnerable ·Cisco
- cpe:2.3:a:cisco:webex_meeting_center:t31:*:*:*:*:*:*:* Versions t31 Vulnerable ·Cisco
- cpe:2.3:a:cisco:webex_meeting_center:t32:*:*:*:*:*:*:* Versions t32 Vulnerable ·Cisco
- cpe:2.3:a:cisco:webex_meetings_server:2.6.0:*:*:*:*:*:*:* Versions 2.6.0 Vulnerable ·Cisco
- cpe:2.3:a:cisco:webex_meetings_server:2.7.0:*:*:*:*:*:*:* Versions 2.7.0 Vulnerable ·Cisco
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2017-12359
- 2026-10-03 Alias added: GHSA-8gqr-jppf-2jgm
References
More Cisco Webex Meeting Center vulnerabilities
- TI-2017-02920 Memory corruption in Cisco WebEx browser extensions CVSS 3.0HIGH 8.8
- TI-2017-04508 Memory corruption in Cisco WebEx Browser Extension CVSS 3.0HIGH 8.8
- TI-2015-05344 The encryption-processing feature in Cisco libSRTP before 1.5.3 allows remote attackers… CVSS 3.0HIGH 7.5
- TI-2015-03527 Cisco WebEx Meeting Center does not properly restrict the content of URLs in GET… CVSS 2.0HIGH 7.5
- TI-2016-01301 Cisco WebEx Meeting Center Original Release Base allows remote attackers to obtain… CVSS 3.0HIGH 7.5
- TI-2010-03126 Stack-based buffer overflow in Cisco WebEx Meeting Center T27LB before SP21 EP3 and T27LC… CVSS 2.0MEDIUM 6.8
Sources
- CVE-2017-12359 · CVE Program
- CVE-2017-12359 · NVD
- FIRST EPSS
- GHSA-8gqr-jppf-2jgm · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences