PT-2022-5830 · Zoom · Zoom Rooms For Conference Room+2

Published 2022-11-17 · Updated 2022-11-22 · CVE-2022-28766

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Zoom Client for Meetings versions prior to 5.12.6 Zoom Rooms for Conference Room versions prior to 5.12.6

Description The issue is related to incorrect code generation management in the Zoom service for video conferencing. Exploitation of this issue may allow an attacker to execute arbitrary code. A local low-privileged user could exploit this vulnerability to run arbitrary code in the context of the Zoom client. The vulnerability is related to a DLL injection vulnerability.

Recommendations For Zoom Client for Meetings versions prior to 5.12.6, update to version 5.12.6 or later to resolve the issue. For Zoom Rooms for Conference Room versions prior to 5.12.6, update to version 5.12.6 or later to resolve the issue. As a temporary workaround, consider restricting access to the Zoom client to minimize the risk of exploitation.

Fix

Code Injection

Uncontrolled Search Path Element

Weakness Enumeration

CWE-94

CWE-427

Related Identifiers

BDU:2022-07242

CVE-2022-28766

Affected Products

Zoom Client For Meetings

Zoom Rooms For Conference Room

Zoom

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2022-28766 · Security Note
• https://explore.zoom.us/en/trust/security/security-bulletin · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-07242 · Security Note
• https://osv.dev/vulnerability/CVE-2022-28766 · Vendor Advisory
• https://t.me/cibsecurity/53125 · Telegram Post
• https://t.me/cvenotify/38236 · Telegram Post
• http://explore.zoom.us/en/trust/security/security-nbulletin/#ZSB-22027 · Note