Is CVE-2017-6753 being actively exploited?

It is not currently in CISA's KEV catalog. Its EPSS exploitation probability is 6%.

What products does CVE-2017-6753 affect?

Tracked products affected include Cisco Webex Meetings. Check the version you run to see whether it is affected.

How do I fix CVE-2017-6753?

Apply the vendor fix promptly. Upgrade affected products to a fixed version.

CVE-2017-6753

Q: What is CVE-2017-6753?

CVE-2017-6753 is a high-severity software vulnerability (Memory corruption) with a CVSS score of 8.8. A vulnerability in Cisco WebEx browser extensions for Google Chrome and Mozilla Firefox could allow an unauthenticated, remote attacker to execute arbitrary code with the privileges of the affected browser on an affected system. This vulner

HIGH severity · CVSS 8.8 · Memory corruption

8.8CVSS HIGH

Summary

A vulnerability in Cisco WebEx browser extensions for Google Chrome and Mozilla Firefox could allow an unauthenticated, remote attacker to execute arbitrary code with the privileges of the affected browser on an affected system. This vulnerability affects the browser extensions for Cisco WebEx Meetings Server, Cisco WebEx Centers (Meeting Center, Event Center, Training Center, and Support Center), and Cisco WebEx Meetings when they are running on Microsoft Windows. The vulnerability is due to a design defect in the extension. An attacker who can convince an affected user to visit an attacker-controlled web page or follow an attacker-supplied link with an affected browser could exploit the vulnerability. If successful, the attacker could execute arbitrary code with the privileges of the affected browser. The following versions of the Cisco WebEx browser extensions are affected: Versions prior to 1.0.12 of the Cisco WebEx extension on Google Chrome, Versions prior to 1.0.12 of the Cisco WebEx extension on Mozilla Firefox. Cisco Bug IDs: CSCvf15012 CSCvf15020 CSCvf15030 CSCvf15033 CSCvf15036 CSCvf15037.

Impact & exploitability

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionRequired

Confidentiality impactHigh

Integrity impactHigh

Availability impactHigh

Exploit probability (EPSS)6%

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected products we track (1)

Cisco Webex Meetings

Recommendation

Apply the vendor fix promptly. Open any affected product above for its exact safe version.

CVE-2017-6753

Summary

Impact & exploitability

Affected products we track (1)

Recommendation

Additional information