LiveActive security incident?Get immediate response
CVE Record

CVE-2017-3823: An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General...

An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Container before 106 on Mozilla Firefox, the GpcContainer Class ActiveX control plugin before 10031.6.2017.0126 on Internet Explorer, and the Download Manager ActiveX control plugin before 2.1.0.10 on Internet Explorer. A vulnerability in these Cisco WebEx browser extensions could allow an unauthenticated, remote attacker to execute arbitrary code with the privileges of the affected browser on an affected system. This vulnerability affects the browser extensions for Cisco WebEx Meetings Server and Cisco WebEx Centers (Meeting Center, Event Center, Training Center, and Support Center) when they are running on Microsoft Windows. The vulnerability is a design defect in an application programing interface (API) response parser within the extension. An attacker that can convince an affected user to visit an attacker-controlled web page or follow an attacker-supplied link with an affected browser could exploit the vulnerability. If successful, the attacker could execute arbitrary code with the privileges of the affected browser.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

CVE-2017-3823 is a remote code execution flaw in legacy Cisco WebEx browser extensions on Windows. A malicious web page or link could make an affected browser run attacker-controlled code with the user’s browser privileges. The bundle does not show confirmed active exploitation.

Executive priority

Treat as high priority for legacy Windows fleets because compromise can occur through normal web browsing and yields code execution in the browser context. Modernized endpoints may have little exposure if old WebEx plugins were removed.

Technical view

The issue is a design defect in an API response parser in Cisco WebEx browser extensions and related Firefox/Internet Explorer plugins. Affected versions include Chrome extension before 1.0.7, Firefox ActiveTouch before 106, IE GpcContainer before 10031.6.2017.0126, and IE Download Manager before 2.1.0.10.

Likely exposure

Exposure is most likely on Windows endpoints with old Cisco WebEx Meetings Server or WebEx Centers browser components installed, especially legacy Internet Explorer ActiveX controls or outdated Chrome/Firefox WebEx extensions.

Exploitation context

Exploitation requires an affected user to open an attacker-controlled page or supplied link in an affected browser. Sources describe arbitrary code execution, but the bundle does not include KEV listing or confirmed in-the-wild exploitation evidence.

Researcher notes

The record maps to CWE-119, but the description emphasizes parser design behavior rather than a detailed memory-corruption primitive. Public Project Zero and third-party references exist; avoid assuming exploit maturity beyond what those sources explicitly state.

Mitigation direction

  • Update WebEx browser components to the fixed versions listed by Cisco.
  • Remove or disable legacy WebEx browser plugins where they are no longer required.
  • Prioritize cleanup on Windows systems using Internet Explorer ActiveX controls.
  • Check Cisco’s advisory for any product-specific replacement or upgrade guidance.

Validation and detection

  • Inventory Windows endpoints for Cisco WebEx Chrome, Firefox, and Internet Explorer browser components.
  • Compare installed component versions against the fixed versions in the Cisco advisory.
  • Confirm whether WebEx Meetings Server or WebEx Centers workflows still require browser plugins.
  • Review browser and endpoint telemetry for users visiting suspicious WebEx-themed links.
Prepared
Confidence
high
Sources
8

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · low confidence lookup

CWE-119: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
description · low confidence lookup

Execution behavior lookup

The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
description · low confidence lookup

Container behavior lookup

The affected technology mentions containers, so container-specific ATT&CK technique review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2017-3823 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
7Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/aCisco WebEx browser extensionsCisco WebEx browser extensionsListed
Weakness

CWE details

CWE-119

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-119 · source CWE mapping

Improper Restriction of Operations within the Bounds of a Memory Buffer

Improper Restriction of Operations within the Bounds of a Memory Buffer represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs