{"schema_version":"public-product-v1.1","generated_at":"2026-07-21T10:26:44Z","exposure_verdict":"not_assessed","verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","advisory":{"id":"cisco-sa-20181024-webex-injection","slug":"cisco-sa-20181024-webex-injection","vendor":"Cisco","title":"Cisco Webex Meetings Desktop App Update Service Command Injection Vulnerability","summary":"A vulnerability in the update service of Cisco Webex Meetings Desktop App for Windows could allow an authenticated, local attacker to execute arbitrary commands as a privileged user. The vulnerability is due to insufficient validation of user-supplied parameters. An attacker could exploit this vulnerability by invoking the update service command with a crafted argument. An exploit could allow the attacker to run arbitrary commands with SYSTEM user privileges. While the CVSS Attack Vector metric denotes the requirement for an attacker to have local access, administrators should be aware that in Active Directory deployments, the vulnerability could be exploited remotely by leveraging the operating system remote management tools. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. After an additional attack method was reported to Cisco, the previous fix for this vulnerability was determined to be insufficient. A new fix was developed, and the advisory was updated on November 27, 2018, to reflect which software releases include the complete fix. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181024-webex-injection","severity":"High","published_at":"2018-10-24T16:00:00Z","updated_at":"2018-11-27T16:01:00Z","source_url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181024-webex-injection","csaf_url":"https://sec.cloudapps.cisco.com/security/center/contentjson/CiscoSecurityAdvisory/cisco-sa-20181024-webex-injection/csaf/cisco-sa-20181024-webex-injection.json","exposure_verdict":"not_assessed","verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure."},"freshness":{"last_source_refreshed_at":"2026-07-21T05:16:34Z","latest_source_refresh_at":"2026-07-21T05:16:34Z","oldest_source_refresh_at":"2026-07-21T03:00:03Z","all_sources_fresh":true,"sources":[{"source":"cisco_advisories","label":"Cisco advisories","last_success_at":"2026-07-21T03:00:03Z","stale":false},{"source":"cisco_csaf","label":"Cisco CSAF","last_success_at":"2026-07-21T05:14:24Z","stale":false},{"source":"nvd_cves","label":"NVD CVEs","last_success_at":"2026-07-21T05:16:30Z","stale":false},{"source":"cisa_kev","label":"CISA KEV","last_success_at":"2026-07-21T05:16:31Z","stale":false},{"source":"first_epss","label":"EPSS","last_success_at":"2026-07-21T05:16:34Z","stale":false}]},"summary":{"cve_count":1,"visible_product_count":4,"public_evidence_count":4,"kev_count":0,"highest_epss":0.1602},"cves":[{"id":"CVE-2018-15442","kev":false,"epss":{"score":0.1602,"percentile":0.96552,"score_date":"2026-07-19","updated_at":"2026-07-20T05:46:48Z"}}],"public_evidence":[{"product":{"name":"Cisco WebEx Event Center","slug":"cisco-webex-event-center","vendor":"Cisco"},"cve":{"id":"CVE-2018-15442"},"evidence_type":"structured_affected","evidence_label":{"scope":"CSAF product evidence","label":"product_status known affected"},"evidence_source":"Cisco CSAF","source":"Cisco CSAF","source_document_fetched_at":"2026-07-20T05:22:01Z","csaf_status":"known_affected","csaf_product_status":"known_affected","csaf_product_status_path":"vulnerabilities[].product_status.known_affected","raw_product_name":"Cisco WebEx Event Center","exposure_verdict":"not_assessed","verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","exposure_verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","kev":false,"epss":{"score":0.1602,"score_date":"2026-07-19","updated_at":"2026-07-20T05:46:48Z"},"published_at":"2018-10-24T16:00:00Z","updated_at":"2018-11-27T16:01:00Z","advisory_updated_at":"2018-11-27T16:01:00Z","source_url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181024-webex-injection","remediation":{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181024-webex-injection"},"row_display_order":1},{"product":{"name":"Cisco WebEx Meeting Center","slug":"cisco-webex-meeting-center","vendor":"Cisco"},"cve":{"id":"CVE-2018-15442"},"evidence_type":"structured_affected","evidence_label":{"scope":"CSAF product evidence","label":"product_status known affected"},"evidence_source":"Cisco CSAF","source":"Cisco CSAF","source_document_fetched_at":"2026-07-20T05:22:01Z","csaf_status":"known_affected","csaf_product_status":"known_affected","csaf_product_status_path":"vulnerabilities[].product_status.known_affected","raw_product_name":"Cisco WebEx Meeting Center","exposure_verdict":"not_assessed","verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","exposure_verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","kev":false,"epss":{"score":0.1602,"score_date":"2026-07-19","updated_at":"2026-07-20T05:46:48Z"},"published_at":"2018-10-24T16:00:00Z","updated_at":"2018-11-27T16:01:00Z","advisory_updated_at":"2018-11-27T16:01:00Z","source_url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181024-webex-injection","remediation":{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181024-webex-injection"},"row_display_order":2},{"product":{"name":"Cisco WebEx Support Center","slug":"cisco-webex-support-center","vendor":"Cisco"},"cve":{"id":"CVE-2018-15442"},"evidence_type":"structured_affected","evidence_label":{"scope":"CSAF product evidence","label":"product_status known affected"},"evidence_source":"Cisco CSAF","source":"Cisco CSAF","source_document_fetched_at":"2026-07-20T05:22:01Z","csaf_status":"known_affected","csaf_product_status":"known_affected","csaf_product_status_path":"vulnerabilities[].product_status.known_affected","raw_product_name":"Cisco WebEx Support Center","exposure_verdict":"not_assessed","verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","exposure_verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","kev":false,"epss":{"score":0.1602,"score_date":"2026-07-19","updated_at":"2026-07-20T05:46:48Z"},"published_at":"2018-10-24T16:00:00Z","updated_at":"2018-11-27T16:01:00Z","advisory_updated_at":"2018-11-27T16:01:00Z","source_url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181024-webex-injection","remediation":{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181024-webex-injection"},"row_display_order":3},{"product":{"name":"Cisco WebEx Training Center","slug":"cisco-webex-training-center","vendor":"Cisco"},"cve":{"id":"CVE-2018-15442"},"evidence_type":"structured_affected","evidence_label":{"scope":"CSAF product evidence","label":"product_status known affected"},"evidence_source":"Cisco CSAF","source":"Cisco CSAF","source_document_fetched_at":"2026-07-20T05:22:01Z","csaf_status":"known_affected","csaf_product_status":"known_affected","csaf_product_status_path":"vulnerabilities[].product_status.known_affected","raw_product_name":"Cisco WebEx Training Center","exposure_verdict":"not_assessed","verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","exposure_verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","kev":false,"epss":{"score":0.1602,"score_date":"2026-07-19","updated_at":"2026-07-20T05:46:48Z"},"published_at":"2018-10-24T16:00:00Z","updated_at":"2018-11-27T16:01:00Z","advisory_updated_at":"2018-11-27T16:01:00Z","source_url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181024-webex-injection","remediation":{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181024-webex-injection"},"row_display_order":4}]}