Cisco Webex Meeting Client Join Certificate Validation Vulnerability

TL;DR 📌

A medium-severity vulnerability in the Cisco Webex Meeting Client could allow an unauthenticated attacker on a local network to join meetings as another user. Cisco has addressed this issue, and no user action is required.

What happened 🕵️‍♂️

A vulnerability was identified in the meeting-join functionality of Cisco Webex Meetings. This flaw could permit an unauthenticated, network-proximate attacker to impersonate a legitimate user during the meeting-join process. The vulnerability arises from issues with client certificate validation, allowing an attacker to intercept and complete a meeting-join flow if they are positioned on a local or adjacent network. Cisco has confirmed that there is no known malicious exploitation of this vulnerability.

Affected products 🖥️

The vulnerability affects the Cisco Webex Meetings service, which is cloud-based.

Fixed software 🔧

Upgrade to the first fixed release in your train (or later):

Workarounds 🧯

There are no workarounds that address this vulnerability.

Risk in context 🎯

With a CVSS score of 5.4, this vulnerability is rated as Medium. The risk is primarily associated with local network exposure, as an attacker would need to be on the same or adjacent network to exploit the vulnerability. While the potential for exploitation exists, Cisco’s Product Security Incident Response Team (PSIRT) has not reported any known instances of this vulnerability being exploited in the wild.

Fast facts ⚡

• Vulnerability: Cisco Webex Meeting Client Join Certificate Validation
• CVSS Score: 5.4 (Medium)
• Exploitation: Requires local network access
• Impact: Allows impersonation of another user during meeting join
• Fix: No user action required; vulnerability addressed by Cisco

For leadership 🧭

Executive summary. A flaw in how the Webex Meetings client validates certificates during meeting join could allow someone on the same or an adjacent network to impersonate a genuine participant. Cisco has already fixed this on its cloud service, so no action is required from your side, but it’s worth confirming your Webex clients are current.

Why it matters:

• The weakness sits in the meeting-join flow itself, meaning impersonation happens before a user is properly authenticated into the session.
• Exploitation requires only local or adjacent network positioning, not stolen credentials, which lowers the bar for anyone already inside a shared office or building network.
• Because Webex Meetings is cloud-based, the fix has been applied server-side by Cisco, but any client-side certificate trust issues on endpoints are still worth checking.
• There is no workaround, so organisations relying on Webex for sensitive discussions had no interim mitigation until the vendor fix was in place.

Now / Next / Later:

• Now: Confirm your Webex Meetings clients are updated to a current release so the corrected certificate validation logic is in effect.
• Next: During your next patch cycle, audit endpoints joining Webex Meetings from shared or less-trusted network segments (e.g. guest Wi-Fi, coworking spaces) to ensure they’re on supported, patched client versions.
• Later: Review network segmentation and access controls around meeting endpoints so that local or adjacent-network attackers have fewer opportunities to intercept join traffic in future.