CVE-2023-36534
📋 TL;DR
A path traversal vulnerability in Zoom Desktop Client for Windows allows unauthenticated attackers to escalate privileges via network access. This affects Windows users running Zoom versions before 5.14.7, potentially enabling attackers to execute arbitrary code with elevated permissions.
💻 Affected Systems
- Zoom Desktop Client
📦 What is this software?
Zoom by Zoom
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise via remote code execution with SYSTEM/administrator privileges, leading to data theft, ransomware deployment, or persistent backdoor installation.
Likely Case
Local privilege escalation allowing attackers to gain administrative access to the Windows system, install malware, or access sensitive files.
If Mitigated
Limited impact with proper network segmentation and endpoint protection blocking malicious traffic.
🎯 Exploit Status
CWE-22 path traversal vulnerabilities typically have low exploitation complexity. The advisory states unauthenticated exploitation is possible via network access.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 5.14.7 or later
Vendor Advisory: https://explore.zoom.us/en/trust/security/security-bulletin/
Restart Required: Yes
Instructions:
1. Open Zoom Desktop Client. 2. Click profile picture → Check for Updates. 3. Install version 5.14.7 or newer. 4. Restart Zoom and computer if prompted.
🔧 Temporary Workarounds
Network Segmentation
allRestrict Zoom client network access to only necessary Zoom services using firewall rules.
Disable Automatic Updates Check
windowsTemporarily disable Zoom's ability to check for updates from network to prevent exploitation vector.
Navigate to Zoom settings → General → Uncheck 'Automatically keep Zoom updated'
🧯 If You Can't Patch
- Uninstall Zoom Desktop Client and use web client version instead
- Implement application whitelisting to prevent unauthorized process execution
🔍 How to Verify
Check if Vulnerable:
Check Zoom version in Settings → About Zoom. If version is below 5.14.7, system is vulnerable.Check Version:
wmic product where name="Zoom" get versionVerify Fix Applied:
Confirm Zoom version is 5.14.7 or higher in Settings → About Zoom.📡 Detection & Monitoring
Log Indicators:
- Unusual Zoom process spawning with elevated privileges
- Zoom accessing unexpected file system locations
Network Indicators:
- Unusual network connections from Zoom process to non-Zoom domains/IPs
- Zoom process making unexpected HTTP requests
SIEM Query:
process_name="Zoom.exe" AND (parent_process!="explorer.exe" OR integrity_level="System")