CVE-2022-22781
📋 TL;DR
This vulnerability in Zoom Client for MacOS allows attackers to downgrade users to older, less secure versions during the update process. It affects MacOS users running Zoom Client versions prior to 5.9.6. An attacker could exploit this to introduce known vulnerabilities that were previously patched.
💻 Affected Systems
- Zoom Client for Meetings (Standard)
- Zoom Client for Meetings (for IT Admin)
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could downgrade users to versions with known critical vulnerabilities (like RCE or privilege escalation), then chain exploits to gain full system control.
Likely Case
Attackers downgrade to versions with moderate vulnerabilities to steal credentials, access meetings, or install malware.
If Mitigated
With proper patching, the vulnerability is eliminated; with network controls, exploitation attempts can be blocked.
🎯 Exploit Status
Exploitation requires tricking user into updating (e.g., via phishing) and controlling update server responses; no public exploits known.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 5.9.6 and later
Vendor Advisory: https://explore.zoom.us/en/trust/security/security-bulletin/
Restart Required: Yes
Instructions:
1. Open Zoom Client. 2. Click your profile picture. 3. Select 'Check for Updates'. 4. If update to 5.9.6+ is available, install it. 5. Restart Zoom after installation.
🔧 Temporary Workarounds
Disable Automatic Updates
macOSPrevent Zoom from automatically checking for updates to block downgrade attempts.
Zoom settings → General → uncheck 'Automatically keep Zoom updated'
Network Block Update Servers
allBlock Zoom update servers at firewall to prevent malicious update responses.
Block domains: *.zoom.us, *.cloudfront.net (update endpoints)
🧯 If You Can't Patch
- Monitor for unusual update prompts or version changes in Zoom logs.
- Educate users to avoid updating Zoom via untrusted links or prompts.
🔍 How to Verify
Check if Vulnerable:
Check Zoom version in app: Click profile picture → About Zoom. If version is below 5.9.6, it's vulnerable.Check Version:
/Applications/zoom.us.app/Contents/MacOS/zoom.us --version (may vary)Verify Fix Applied:
Confirm version is 5.9.6 or higher in About Zoom dialog.📡 Detection & Monitoring
Log Indicators:
- Zoom logs showing update to version below 5.9.6
- Unexpected update prompts in system logs
Network Indicators:
- HTTP requests to Zoom update servers with unusual version strings
- DNS queries to Zoom domains from unexpected sources
SIEM Query:
source="zoom.log" AND ("update" OR "downgrade") AND version<"5.9.6"