Sunday, May 4, 2025
HomeCyber Security NewsBeware! Hackers Can Now Exploit a Security Flaw in Zoom Client

Beware! Hackers Can Now Exploit a Security Flaw in Zoom Client

Published on

SIEM as a Service

Follow Us on Google News

The popular video messaging platform Zoom has discovered multiple vulnerabilities affecting Zoom Clients. These vulnerabilities might allow an unauthorized user to carry out denial-of-service, privilege escalation, and information disclosure attacks.

To receive the most recent security updates and bug fixes, Zoom advises users to update to the most recent version of the Zoom software.

High Severity Vulnerabilities Impacting Zoom Clients

Improper Authentication – CVE-2023-39215

- Advertisement - Google News

With a CVSS Base Score of 7.1 and a High severity vulnerability listed as CVE-2023-39215, improper authentication in Zoom clients may enable an authenticated user to utilize network access to perform a denial of service attack.

Affected Products:

  • Zoom Desktop Client for Windows before version 5.15.5
  • Zoom Desktop Client for macOS before version 5.15.5
  • Zoom Desktop Client for Linux before version 5.15.5
  • Zoom VDI Client before version 5.14.12
  • Zoom VDI Client before version 5.15.4
  • Zoom Mobile App for Android before version 5.15.5
  • Zoom Mobile App for iOS before version 5.15.5
  • Zoom Meeting SDK’s before version 5.15.5

Exposure of Sensitive Information – CVE-2023-39214

A high-severity vulnerability with a CVSS Base Score of 7.6 is identified as CVE-2023-39214. It involves the exposure of sensitive data in Zoom Client versions before 5.15.5, which could enable a denial of service via network access for an authenticated user.

Affected Products:

  • Zoom Desktop Client for Windows before version 5.15.5
  • Zoom Desktop Client for macOS before version 5.15.5
  • Zoom Desktop Client for Linux before version 5.15.5
  • Zoom Mobile App for Android before version 5.15.5
  • Zoom Mobile App for iOS before version 5.15.5
  • Zoom Rooms for iPad before version 5.15.5
  • Zoom Rooms for Android before version 5.15.5
  • Zoom Rooms for Windows before version 5.15.5
  • Zoom Rooms for macOS before version 5.15.5

Client-Side Enforcement of Server-Side Security – CVE-2023-36535

Before version 5.14.10, client-side enforcement of server-side security in Zoom clients may have allowed an authenticated user to enable information exposure via network access.

This high-severity vulnerability was identified as CVE-2023-36535 and has a CVSS Base Score of 7.1.

Affected Products:

  • Zoom Clients for Windows before version 5.14.10
  • Zoom Desktop Client for macOS before version 5.14.10
  • Zoom Desktop Client for Linux before version 5.14.10
  • Zoom VDI Host and Plugin before version 5.14.10
  • Zoom Mobile App for Android before version 5.14.10
  • Zoom Mobile App for iOS before version 5.14.10
  • Zoom Rooms for iPad before version 5.14.10
  • Zoom Rooms for Android before version 5.14.10
  • Zoom Rooms for Windows before version 5.14.10
  • Zoom Rooms for macOS before version 5.14.10

Medium and Low-Severity Vulnerabilities Impacting Zoom Clients

Improper Authorization (CVE-2023-43582), Insufficient Control Flow Management (CVE-2023-43588), Cryptographic Issues (CVE-2023-39199), Buffer Overflow (CVE-2023-39206, CVE-2023-39204, CVE-2023-36532), Improper Conditions Check (CVE-2023-39205), 

Client-Side Enforcement of Server-Side Security (CVE-2023-39218), Improper Input Validation (CVE-2023-39217).

Update Now!

Users are advised to stay safe by installing the most recent updates or getting the most recent Zoom software which includes all security updates.

Patch Manager Plus, the one-stop solution for automated updates of over 850 third-party applications: Try Free Trial.

Gurubaran
Gurubaran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Latest articles

MintsLoader Malware Uses Sandbox and Virtual Machine Evasion Techniques

MintsLoader, a malicious loader first observed in 2024, has emerged as a formidable tool...

Threat Actors Use AiTM Attacks with Reverse Proxies to Bypass MFA

Cybercriminals are intensifying their efforts to undermine multi-factor authentication (MFA) through adversary-in-the-middle (AiTM) attacks,...

Threat Actors Target Critical National Infrastructure with New Malware and Tools

A recent investigation by the FortiGuard Incident Response (FGIR) team has uncovered a sophisticated,...

New StealC V2 Upgrade Targets Microsoft Installer Packages and PowerShell Scripts

StealC, a notorious information stealer and malware downloader first sold in January 2023, has...

Resilience at Scale

Why Application Security is Non-Negotiable

The resilience of your digital infrastructure directly impacts your ability to scale. And yet, application security remains a critical weak link for most organizations.

Application Security is no longer just a defensive play—it’s the cornerstone of cyber resilience and sustainable growth. In this webinar, Karthik Krishnamoorthy (CTO of Indusface) and Phani Deepak Akella (VP of Marketing – Indusface), will share how AI-powered application security can help organizations build resilience by

Discussion points


Protecting at internet scale using AI and behavioral-based DDoS & bot mitigation.
Autonomously discovering external assets and remediating vulnerabilities within 72 hours, enabling secure, confident scaling.
Ensuring 100% application availability through platforms architected for failure resilience.
Eliminating silos with real-time correlation between attack surface and active threats for rapid, accurate mitigation

More like this

MintsLoader Malware Uses Sandbox and Virtual Machine Evasion Techniques

MintsLoader, a malicious loader first observed in 2024, has emerged as a formidable tool...

Threat Actors Use AiTM Attacks with Reverse Proxies to Bypass MFA

Cybercriminals are intensifying their efforts to undermine multi-factor authentication (MFA) through adversary-in-the-middle (AiTM) attacks,...

Threat Actors Target Critical National Infrastructure with New Malware and Tools

A recent investigation by the FortiGuard Incident Response (FGIR) team has uncovered a sophisticated,...