Vulnerability · Published Nov 11, 2021 · Assigned by Zoom

CVE-2021-34417Authenticated remote command execution with root privileges via web console in MMR

High 7.9

In plain English

A high-severity security flaw in Zoom On-Premise Meeting Connector Controller from Zoom Video Communications Inc. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 69% of all known vulnerabilities).

Severity (CVSS 3.1)7.9High

Exploit odds (30 days)1.2%top 30.8% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

The network proxy page on the web portal for the Zoom On-Premise Meeting Connector Controller before version 4.6.365.20210703, Zoom On-Premise Meeting Connector MMR before version 4.6.365.20210703, Zoom On-Premise Recording Connector before version 3.8.45.20210703, Zoom On-Premise Virtual Room Connector before version 4.4.6868.20210703, and Zoom On-Premise Virtual Room Connector Load Balancer before version 2.5.5496.20210703 fails to validate input sent in requests to set the network proxy password. This could lead to remote command injection by a web portal administrator.

Affected products (as reported)

Vendor	Product	Versions
Zoom Video Communications Inc	Zoom On-Premise Meeting Connector Controller	unspecified – before 4.6.365.20210703
Zoom Video Communications Inc	Zoom On-Premise Meeting Connector MMR	unspecified – before 4.6.365.20210703
Zoom Video Communications Inc	Zoom On-Premise Recording Connector	unspecified – before 3.8.45.20210703
Zoom Video Communications Inc	Zoom On-Premise Virtual Room Connector	unspecified – before 4.4.6868.20210703
Zoom Video Communications Inc	Zoom On-Premise Virtual Room Connector Load Balancer	unspecified – before 2.5.5496.20210703

References

https://explore.zoom.us/en/trust/security/security-bulletin x_refsource_MISC