Zoom Rooms for macOS clients before version 5.11.4 contain an insecure key generation mechanism. The encryption key used for IPC between the Zoom Rooms daemon service and the Zoom Rooms client was generated using parameters that could be obtained by a local low-privileged application. That key can then be used to interact with the daemon service to execute privileged functions and cause a local denial of service.
References
| Link | Resource |
|---|---|
| https://explore.zoom.us/en/trust/security/security-bulletin/ | Vendor Advisory |
Configurations
History
13 Jan 2023, 19:47
| Type | Values Removed | Values Added |
|---|---|---|
| References | (MISC) https://explore.zoom.us/en/trust/security/security-bulletin/ - Vendor Advisory | |
| CWE | CWE-798 | |
| First Time |
Zoom rooms
Zoom |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.8 |
| CPE | cpe:2.3:a:zoom:rooms:*:*:*:*:*:macos:*:* |
09 Jan 2023, 19:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-01-09 19:15
Updated : 2023-12-10 14:48
NVD link : CVE-2022-36925
Mitre link : CVE-2022-36925
CVE.ORG link : CVE-2022-36925
JSON object : View
Products Affected
zoom
- rooms