CVE-2023-34121: medium-severity vulnerability in Zoom for Windows
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 4.1epss 1.0%
In short
Zoom's Windows client versions before 5.14.0 don't properly check user input, which could let a logged-in user gain higher privileges on the system through a network connection.
Technical detail
CWE-79 input validation flaw in Zoom Windows/Rooms/VDI clients <5.14.0 allows authenticated network-based privilege escalation; requires valid user credentials and network access to the vulnerable client.
Summary generated and translated by AI from the official description.
Improper input validation in the Zoom for Windows, Zoom Rooms, Zoom VDI Windows Meeting clients before 5.14.0 may allow an authenticated user to potentially enable an escalation of privilege via network access.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N
Affected products
Zoom Video Communications, Inc. · Zoom for WindowsZoom Video Communications, Inc. · Zoom Rooms Client for WindowsZoomZoom Video Communications, Inc. · Zoom VDI for Windows Meeting ClientsRelated CVEs — Zoom for Windows
In the same product, most dangerous first.