CVE-2023-39213: critical vulnerability in Zoom Desktop Client for Windows and Zoom VDI…
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
Zoom Desktop Client for Windows has a flaw that allows an attacker to bypass security controls and gain higher privileges on a computer without needing a password or user account. This is critical because attackers on the network can exploit it remotely.
CWE-176 (improper neutralization of special elements) in Zoom Desktop Client for Windows and VDI Client before 5.15.2 permits unauthenticated network-based privilege escalation. The vulnerability stems from insufficient input validation of special characters or crafted elements in network communications, enabling attackers to trigger unintended code execution or privilege elevation without authentication.