Security News > 2020 > September > Attackers Can Exploit Critical Cisco Jabber Flaw With One Message
Researchers are warning of a critical remote code-execution flaw in the Windows version of Cisco Jabber, the networking company's video-conferencing and instant-messaging application.
The flaw has a CVSS score of 9.9 out of 10, making it critical in severity, Cisco said in a Wednesday advisory.
An attacker could exploit the flaw by sending specially crafted Extensible Messaging and Presence Protocol messages to vulnerable end-user systems running Cisco Jabber for Windows.
The issue stems from Cisco Jabber improperly validating message contents; the application does not properly sanitize incoming HTML messages.
Cisco has released updates for different releases of affected Cisco Jabber.
News URL
https://threatpost.com/attackers-can-exploit-critical-cisco-jabber-flaw-with-one-message/158942/
Related news
- Exploit released for Cisco SSM bug allowing admin password changes (source)
- Cisco warns of critical RCE zero-days in end of life IP phones (source)
- Ivanti warns of critical vTM auth bypass with public exploit (source)
- Chinese Hackers Exploit Zero-Day Cisco Switch Flaw to Gain System Control (source)
- Week in review: SonicWall critical firewalls flaw fixed, APT exploits WPS Office for Windows RCE (source)
- Cisco fixes root escalation vulnerability with public exploit code (source)
- Cisco Fixes Two Critical Flaws in Smart Licensing Utility to Prevent Remote Attacks (source)
- Exploit code released for critical Ivanti RCE flaw, patch now (source)