CVE-2024-24691

· CRITICALModified

← All CVEs

CVSS v3.1

9.6

EPSS

1.69%

Published

Feb 13, 2024

Modified

Nov 21, 2024

Public PoC / Exploit (1)

All weaponized →

TrickestTrickest PoC index

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

Improper input validation in Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for Windows may allow an unauthenticated user to conduct an escalation of privilege via network access.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Weaknesses (CWE)

CWE-176

Affected Products (6)

zoom · meeting_software_development_kit (up to 5.16.5)vulnerable

zoom · rooms (up to 5.17.0)vulnerable

zoom · vdi_windows_meeting_clients (up to 5.14.14)vulnerable

zoom · vdi_windows_meeting_clients (up to 5.15.12)vulnerable

zoom · vdi_windows_meeting_clients (up to 5.16.10)vulnerable

zoom · zoom (up to 5.16.5)vulnerable

References (2)

https://www.zoom.com/en/trust/security-bulletin/ZSB-24008/

Vendor Advisory

https://www.zoom.com/en/trust/security-bulletin/ZSB-24008/

Vendor Advisory

KEV Catalog EPSS Scores Vendors All CVEs