PT-2021-20519 · Zoom · Zoom Rooms For Conference Room For Windows

Published 2021-09-27 · Updated 2021-10-06 · CVE-2021-34411

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Zoom Rooms for Conference Room for Windows versions prior to 5.3.0

Description: The issue allows for the launch of Internet Explorer with elevated privileges during the installation process. If the installer is launched with elevated privileges, such as by SCCM, this can result in a local privilege escalation.

Recommendations: For versions prior to 5.3.0, update to version 5.3.0 or later to resolve the issue. As a temporary workaround, consider avoiding the launch of the installer with elevated privileges to minimize the risk of exploitation. Restrict access to the installation process to prevent potential abuse.

Fix

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2021-34411

Affected Products

Zoom Rooms For Conference Room For Windows

References · 6

• https://explore.zoom.us/en/trust/security/security-bulletin · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-34411 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-34411 · Security Note
• https://t.me/cvenotify/21801 · Telegram Post
• https://t.me/cvenotify/21512 · Telegram Post
• https://t.me/cibsecurity/29475 · Telegram Post