CVE-2025-0147
📋 TL;DR
A type confusion vulnerability in Zoom Workplace App for Linux allows authenticated users to escalate privileges through network access. This affects Linux users running vulnerable versions of the Zoom Workplace App. Attackers could gain elevated system access by exploiting this flaw.
💻 Affected Systems
- Zoom Workplace App
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
An authenticated attacker could gain root privileges on the Linux system, potentially compromising the entire machine and accessing sensitive data or deploying malware.
Likely Case
An authenticated user could elevate their privileges to gain unauthorized access to system resources, user data, or perform administrative actions.
If Mitigated
With proper access controls and network segmentation, impact would be limited to the affected user's scope and system.
🎯 Exploit Status
Requires authenticated user access and network connectivity to the target system.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 6.2.10 or later
Vendor Advisory: https://www.zoom.com/en/trust/security-bulletin/zsb-25006/
Restart Required: No
Instructions:
1. Open Zoom Workplace App. 2. Click your profile picture. 3. Select 'Check for Updates'. 4. Follow prompts to update to version 6.2.10 or later. 5. Alternatively, download latest version from zoom.us/download.
🔧 Temporary Workarounds
Disable Zoom Workplace App
LinuxTemporarily disable or uninstall Zoom Workplace App until patched
sudo systemctl stop zoom
sudo apt remove zoom
🧯 If You Can't Patch
- Restrict network access to Zoom Workplace App using firewall rules
- Implement strict user privilege separation and monitor for privilege escalation attempts
🔍 How to Verify
Check if Vulnerable:
Check Zoom version in app settings or run: zoom --versionCheck Version:
zoom --versionVerify Fix Applied:
Confirm version is 6.2.10 or later using: zoom --version📡 Detection & Monitoring
Log Indicators:
- Unexpected privilege escalation events in system logs
- Zoom process running with elevated privileges unexpectedly
Network Indicators:
- Unusual network connections from Zoom process
- Network traffic patterns suggesting exploitation
SIEM Query:
process.name:"zoom" AND event.action:"privilege_escalation" OR user.id_changed:true