CVE-2019-1689 json
Cisco Webex Teams for iOS Arbitrary File Upload Vulnerability
published 2019-02-25 7 y ago modified 2026-06-17 4 mo ago also EUVD-2019-10246
- cvss
- 7.3
- version 3.0, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.6%
- EPSS 1.6% chance of exploitation in 30 days, percentile 75%
- public exploits
- 0
- none known
Summary
A vulnerability in the client application for iOS of Cisco Webex Teams could allow an authenticated, remote attacker to upload arbitrary files within the scope of the iOS application. The vulnerability is due to improper input validation in the client application. An attacker could exploit this vulnerability by sending a malicious file to a targeted user and persuading the user to manually open it. An exploit could allow the attacker to overwrite sensitive application files and eventually cause a denial of service (DoS) condition by foreclosing future access to the system to the targeted user. This vulnerability is fixed in version 3.13.26920.
Patch / fix
- Cisco Cisco Webex Teams 3.13.26920
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 23 mo ago
Exploit prediction
1.57% chance of exploitation in the next 30 days, higher than 75% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- tools.cisco.com https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190220-webx-ios-file referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.0 | 7.3 | CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H |
| NVD | 3.1 | 7.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H |
| NVD | 2.0 | 4.9 | AV:N/AC:M/Au:S/C:N/I:P/A:P |
Affected products
- Cisco Cisco Webex Teams
Classification
- Weakness
-
- CWE-20 Improper Input Validation
References
-
tools.cisco.com
/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190220-webx-ios-file
vendor-advisory, exploit
-
securityfocus.com
/bid/107101
vdb-entry, broken-link, third-party-advisory
Sources
- CVE List CVE-2019-1689
- NVD CVE-2019-1689
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.