CVE-2019-19810
📋 TL;DR
CVE-2019-19810 is a critical Java deserialization vulnerability in Zoom Call Recording 6.3.1 from Eleveo that allows remote unauthenticated attackers to execute arbitrary code via crafted RMI requests. This affects organizations using the vulnerable version of the Zoom Call Recording software. The vulnerability stems from insecure deserialization in the built-in RMI service.
💻 Affected Systems
- Zoom Call Recording from Eleveo
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining full control over the host, installing malware, stealing data, and pivoting to other systems.
Likely Case
Remote code execution leading to data theft, ransomware deployment, or creation of persistent backdoors.
If Mitigated
No impact if proper network segmentation and access controls prevent RMI service exposure.
🎯 Exploit Status
Public exploit code exists and the attack requires minimal technical skill to execute.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 6.3.2 or later
Vendor Advisory: https://www.eleveo.com/security-advisory/
Restart Required: Yes
Instructions:
1. Download the latest version from Eleveo. 2. Backup current configuration. 3. Install the update. 4. Restart the Zoom Call Recording service.
🔧 Temporary Workarounds
Block RMI Ports
linuxBlock network access to the RMI service ports (typically 1099/tcp and 1098/tcp)
iptables -A INPUT -p tcp --dport 1099 -j DROP
iptables -A INPUT -p tcp --dport 1098 -j DROP
Disable RMI Service
allConfigure the application to disable the RMI service if not required
Edit application configuration to set rmi.enabled=false
🧯 If You Can't Patch
- Implement strict network segmentation to isolate the vulnerable system from untrusted networks
- Deploy application-level firewalls or WAF with deserialization attack detection rules
🔍 How to Verify
Check if Vulnerable:
Check if Zoom Call Recording version is 6.3.1 and RMI service is accessible on ports 1099/tcp or 1098/tcpCheck Version:
Check application interface or configuration files for version informationVerify Fix Applied:
Verify version is 6.3.2 or later and test RMI service with deserialization payloads📡 Detection & Monitoring
Log Indicators:
- Unusual RMI connection attempts
- Java deserialization errors in application logs
- Suspicious process creation
Network Indicators:
- RMI traffic to ports 1099/tcp or 1098/tcp with unusual payloads
- Outbound connections from the system after RMI requests
SIEM Query:
source="zoom-call-recording.log" AND ("RMI" OR "deserialization" OR "1099" OR "1098")