CVE-2023-28597
High
Description
Zoom clients prior to 5.13.5 contain an improper trust boundary implementation vulnerability. If a victim saves a local recording to an SMB location and later opens it using a link from Zoom’s web portal, an attacker positioned on an adjacent network to the victim client could set up a malicious SMB server to respond to client requests, causing the client to execute attacker controlled executables. This could result in an attacker gaining access to a user's device and data, and remote code execution.
SeverityHigh
CVSS8.3
Exploit probability—
Product
Zoom
PublishedMar 27, 2023
First seenMar 27, 2023
Weakness typeCWE-501CWE-501
How to fix
Update
- zoom zoom5.13.5 or later
- zoom rooms5.13.5 or later
- zoom virtual_desktop_infrastructure5.13.10 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| zoom zoom | v < 5.13.5 | 5.13.5 |
| zoom rooms | v < 5.13.5 | 5.13.5 |
| zoom virtual_desktop_infrastructure | v < 5.13.10 | 5.13.10 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.