CVE-2024-24691
📋 TL;DR
This vulnerability allows an unauthenticated attacker on the same network to escalate privileges on Windows systems running affected Zoom software. It affects Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for Windows. Attackers can potentially gain elevated system access without authentication.
💻 Affected Systems
- Zoom Desktop Client for Windows
- Zoom VDI Client for Windows
- Zoom Meeting SDK for Windows
📦 What is this software?
Rooms by Zoom
Zoom by Zoom
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with administrative privileges, allowing installation of malware, data theft, and lateral movement across the network.
Likely Case
Local privilege escalation leading to unauthorized access to sensitive files, system configuration changes, or persistence mechanisms.
If Mitigated
Limited impact if network segmentation prevents unauthenticated network access to vulnerable systems.
🎯 Exploit Status
The vulnerability requires network access but no authentication, making it relatively easy to exploit if network conditions allow.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 5.17.10 and later
Vendor Advisory: https://www.zoom.com/en/trust/security-bulletin/ZSB-24008/
Restart Required: Yes
Instructions:
1. Open Zoom Desktop Client. 2. Click your profile picture. 3. Select 'Check for Updates'. 4. If update is available, click 'Update'. 5. Restart Zoom after installation completes.
🔧 Temporary Workarounds
Network Segmentation
allRestrict network access to Zoom clients to trusted networks only
Disable Unnecessary Services
windowsDisable Zoom services when not in use to reduce attack surface
sc stop ZoomService
sc config ZoomService start= disabled
🧯 If You Can't Patch
- Implement strict network segmentation to isolate Zoom clients from untrusted networks
- Use application whitelisting to prevent unauthorized processes from executing
🔍 How to Verify
Check if Vulnerable:
Check Zoom version in Settings > About Zoom. If version is below 5.17.10, system is vulnerable.Check Version:
wmic product where "name like 'Zoom%'" get versionVerify Fix Applied:
Confirm Zoom version is 5.17.10 or higher in Settings > About Zoom.📡 Detection & Monitoring
Log Indicators:
- Unusual process creation from Zoom executables
- Failed privilege escalation attempts in Windows Event Logs
Network Indicators:
- Unexpected network connections to Zoom client ports from untrusted sources
SIEM Query:
EventID=4688 AND ProcessName LIKE '%zoom%' AND NewProcessName LIKE '%system%' OR EventID=4672