CVE-2019-1674

🗓️ 28 Feb 2019 18:00:00Reported by ciscoType

cve🔗 web.nvd.nist.gov👁 95 Views🌐 WEB

A vulnerability in the Cisco Webex Meetings Desktop App and Productivity Tools for Windows allows local attackers to execute arbitrary commands as a privileged user

Reporter	Title	Published	Views	Family All 13
0day.today	Cisco WebEx Meetings < 33.6.6 / < 33.9.1 - Privilege Escalation Exploit	2 Mar 201900:00	–	zdt
BDU FSTEC	The vulnerability of the software update service for Cisco Webex Meetings Desktop App and Webex Productivity Tools allows a perpetrator to execute arbitrary commands.	12 Mar 201900:00	–	bdu_fstec
Cisco	Cisco Webex Meetings Desktop App and Cisco Webex Productivity Tools Update Service Command Injection Vulnerability	27 Feb 201916:00	–	cisco
CNVD	Cisco Webex Meetings Desktop App and Cisco Webex Productivity Tools Operating System Command Injection Vulnerability	28 Feb 201900:00	–	cnvd
Cvelist	CVE-2019-1674 Cisco Webex Meetings Desktop App and Cisco Webex Productivity Tools Update Service Command Injection Vulnerability	28 Feb 201918:00	–	cvelist
Exploit DB	Cisco WebEx Meetings < 33.6.6 / < 33.9.1 - Privilege Escalation	1 Mar 201900:00	–	exploitdb
exploitpack	Cisco WebEx Meetings 33.6.6 33.9.1 - Privilege Escalation	1 Mar 201900:00	–	exploitpack
NVD	CVE-2019-1674	28 Feb 201918:29	–	nvd
OSV	CVE-2019-1674	28 Feb 201918:29	–	osv
Packet Storm	Cisco WebEx Meetings Privilege Escalation	28 Feb 201900:00	–	packetstorm

NVD

Node

cisco webex_meetingsRange<33.6.6desktop

cisco webex_meetings_onlineMatcht33.0.5

cisco webex_meetings_onlineMatcht33.6.0

cisco webex_meetings_onlineMatcht33.6.1

cisco webex_meetings_onlineMatcht33.6.2

cisco webex_productivity_toolsRange32.6.0–33.0.7

AND

microsoft windowsMatch-

[
  {
    "product": "Cisco Webex Meetings Desktop App",
    "vendor": "Cisco",
    "versions": [
      {
        "lessThan": "33.6.6",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "33.9.1",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "Cisco Webex Productivity Tools",
    "vendor": "Cisco",
    "versions": [
      {
        "lessThan": "33.0.7",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
exploit-db	www.exploit-db.com/exploits/46479/
tools	www.tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190227-wmda-cmdinj
securityfocus	www.securityfocus.com/bid/107184

Parameter	Position	Path	Description	CWE
attacker-controlled-path	path	dummy/upgradeserver/client/ptool/33.8.3	OS command injection via crafted update path argument in Webex update service leading to arbitrary command execution.	CWE-78
attacker-controlled-path	path	dummy/upgradeserver/client/ptool/33.8.4	OS command injection via crafted update path argument in Webex update service leading to arbitrary command execution.	CWE-78

17 Jun 2026 02:29Current

8.3High risk

Vulners AI Score8.3

CVSS 37.8 - 8.8

CVSS 29

EPSS0.10759

SSVC

CWE-78