CVE-2024-24693
📋 TL;DR
An improper access control vulnerability in the Zoom Rooms Client for Windows installer allows authenticated local users to cause denial of service. This affects organizations using Zoom Rooms on Windows systems where users have local access to the installation directory. The vulnerability is present in versions before 5.17.5.
💻 Affected Systems
- Zoom Rooms Client for Windows
📦 What is this software?
Rooms by Zoom
⚠️ Risk & Real-World Impact
Worst Case
An authenticated local user could disrupt Zoom Rooms functionality, potentially affecting meeting room availability and business operations.
Likely Case
Local users with standard privileges could interfere with Zoom Rooms installation or operation, causing temporary service disruption.
If Mitigated
With proper access controls and patching, the risk is minimal as only authenticated local users can exploit this vulnerability.
🎯 Exploit Status
Exploitation requires authenticated local access. No public exploit code has been disclosed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 5.17.5
Vendor Advisory: https://www.zoom.com/en/trust/security-bulletin/zsb-24009/
Restart Required: Yes
Instructions:
1. Download Zoom Rooms Client version 5.17.5 or later from the official Zoom website. 2. Run the installer to update the existing installation. 3. Restart the system to complete the update.
🔧 Temporary Workarounds
Restrict local access
windowsLimit local user access to Zoom Rooms installation directories and system resources
🧯 If You Can't Patch
- Implement strict access controls to limit which users can access Zoom Rooms installation directories
- Monitor for unusual activity related to Zoom Rooms processes and installation directories
🔍 How to Verify
Check if Vulnerable:
Check Zoom Rooms Client version in the application settings or About dialogCheck Version:
Check version in Zoom Rooms Client settings or via Windows Programs and FeaturesVerify Fix Applied:
Confirm Zoom Rooms Client version is 5.17.5 or later in the application settings📡 Detection & Monitoring
Log Indicators:
- Unusual access attempts to Zoom Rooms installation directories
- Failed installation or update attempts
Network Indicators:
- None - this is a local vulnerability
SIEM Query:
Search for file access events in Zoom Rooms installation directories by non-administrative users