Vulnerability · Published Mar 27, 2023 · Assigned by Zoom
CVE-2023-28597Improper trust boundary implementation for SMB in Zoom Clients
High 8.3
In plain English
A high-severity security flaw in Zoom (for Android, iOS, Linux, macOS, and Windows) from Zoom Video Communications Inc. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities).
Official description
Zoom clients prior to 5.13.5 contain an improper trust boundary implementation vulnerability. If a victim saves a local recording to an SMB location and later opens it using a link from Zoom’s web portal, an attacker positioned on an adjacent network to the victim client could set up a malicious SMB server to respond to client requests, causing the client to execute attacker controlled executables. This could result in an attacker gaining access to a user's device and data, and remote code execution.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Zoom Video Communications Inc | Zoom (for Android, iOS, Linux, macOS, and Windows) | unspecified – before 5.13.5 |
| Zoom Video Communications Inc | Zoom Rooms (for Android, iOS, Linux, macOS, and Windows) | unspecified – before 5.13.5 |
| Zoom Video Communications Inc | Zoom VDI for Windows | unspecified – before 5.13.10 |
Weakness: CWE-501 · Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H