CVE-2023-34116: high-severity vulnerability in Zoom Desktop Client for Windows
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.2epss 1.0%
In short
The Zoom Desktop Client for Windows before version 5.15.0 fails to properly validate user input, which could allow an attacker on the network to gain elevated privileges on the system.
Technical detail
CWE-78 (OS Command Injection) via improper input validation in Zoom Desktop Client for Windows <5.15.0 enables privilege escalation through network-accessible vectors. Attack requires network access but not prior authentication; successful exploitation grants elevated system privileges.
Summary generated and translated by AI from the official description.
Improper input validation in the Zoom Desktop Client for Windows before version 5.15.0 may allow an unauthorized user to enable an escalation of privilege via network access.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:H
Affected products
Zoom Video Communications, Inc. · Zoom Desktop Client for WindowsRelated CVEs — Zoom Desktop Client for Windows
In the same product, most dangerous first.
CVE-2023-36534CRITICALCVE-2023-36534EPSS 1.6%CVE-2023-39216CRITICALCVE-2023-39216EPSS 1.2%CVE-2023-39209MEDIUMCVE-2023-39209EPSS 1.0%CVE-2023-36541HIGHCVE-2023-36541EPSS 0.5%CVE-2023-36540HIGHCVE-2023-36540EPSS 0.3%CVE-2024-24694MEDIUMZoom Desktop Client for Windows - Improper Privilege ManagementEPSS 0.2%