PT-2022-4376 · Zoom · Zoom Rooms For Conference Room For Windows+1

Sim0Nsecurity · Published 2022-08-17 · Updated 2022-08-19 · CVE-2022-28752

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Zoom Rooms for Conference Rooms for Windows versions before 5.11.0 Zoom Client for Meetings for macOS (affected versions not specified)

Description The issue is related to a Local Privilege Escalation vulnerability that could be exploited by a local low-privileged malicious user to escalate their privileges to the SYSTEM user. Additionally, there is an issue with the Zoom Client for Meetings for macOS related to incorrect cryptographic signature verification, which could allow an attacker to execute arbitrary code with root privileges.

Recommendations For Zoom Rooms for Conference Rooms for Windows versions before 5.11.0: Update to version 5.11.0 or later to resolve the issue. For Zoom Client for Meetings for macOS: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-347

Related Identifiers

BDU:2022-05239

CVE-2022-28752

Affected Products

Zoom Client For Meetings For Macos

Zoom Rooms For Conference Room For Windows

References · 5

• https://explore.zoom.us/en/trust/security/security-bulletin · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-05239 · Security Note
• https://osv.dev/vulnerability/CVE-2022-28752 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-28752 · Security Note
• https://t.me/cibsecurity/48324 · Telegram Post