CVE-2023-28597
📋 TL;DR
Zoom clients before version 5.13.5 have a vulnerability where saving recordings to SMB locations and opening them via Zoom's web portal can allow adjacent network attackers to intercept requests with malicious SMB servers. This enables remote code execution on the victim's device, affecting all Zoom users who save recordings to network shares.
💻 Affected Systems
- Zoom Client
📦 What is this software?
Rooms by Zoom
Rooms by Zoom
Rooms by Zoom
Rooms by Zoom
Rooms by Zoom
Zoom by Zoom
Zoom by Zoom
Zoom by Zoom
Zoom by Zoom
Zoom by Zoom
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with attacker gaining complete control over the victim's device, data exfiltration, and persistent access.
Likely Case
Attacker executes arbitrary code with user privileges, potentially installing malware, stealing credentials, or accessing sensitive files.
If Mitigated
No impact if Zoom is updated to patched version or workarounds preventing SMB recording access are implemented.
🎯 Exploit Status
Exploitation requires attacker to be on same network segment as victim and requires user interaction (opening recording link).
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 5.13.5 and later
Vendor Advisory: https://explore.zoom.us/en/trust/security/security-bulletin/
Restart Required: Yes
Instructions:
1. Open Zoom client. 2. Click profile icon → Check for Updates. 3. Install version 5.13.5 or newer. 4. Restart Zoom client.
🔧 Temporary Workarounds
Disable SMB recording access
allPrevent Zoom from accessing recordings via SMB protocol
Not applicable - configuration change only
Network segmentation
allIsolate Zoom clients from potential malicious SMB servers
Configure firewall rules to block SMB traffic (ports 139/445) between Zoom clients and untrusted networks
🧯 If You Can't Patch
- Do not save Zoom recordings to SMB network locations
- Use VPN when accessing Zoom recordings from untrusted networks
🔍 How to Verify
Check if Vulnerable:
Check Zoom client version in Settings → AboutCheck Version:
On Windows: zoom.exe --version | On macOS: /Applications/zoom.us.app/Contents/Info.plist | On Linux: dpkg -l | grep zoomVerify Fix Applied:
Confirm version is 5.13.5 or higher📡 Detection & Monitoring
Log Indicators:
- Unusual SMB connections from Zoom process
- Zoom accessing unexpected network shares
Network Indicators:
- SMB traffic from Zoom clients to unknown IPs
- Unexpected SMB server responses
SIEM Query:
process_name="zoom.exe" AND dest_port IN (139, 445)