CVE-2025-46788
📋 TL;DR
Zoom Workplace for Linux versions before 6.4.13 have improper certificate validation that could allow an attacker to intercept communications and access sensitive information. This affects Linux users running vulnerable Zoom Workplace versions who connect to potentially malicious networks.
💻 Affected Systems
- Zoom Workplace
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
An attacker could perform a man-in-the-middle attack to intercept and decrypt Zoom communications, potentially accessing meeting content, chat messages, file transfers, and authentication credentials.
Likely Case
Information disclosure of meeting content, chat conversations, or file transfers when users connect to compromised or malicious networks.
If Mitigated
Limited impact if proper network segmentation and certificate pinning are in place, though some information disclosure may still occur.
🎯 Exploit Status
Exploitation requires network position to intercept traffic and ability to present invalid certificates. No authentication required to trigger the vulnerability.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 6.4.13
Vendor Advisory: https://www.zoom.com/en/trust/security-bulletin/zsb-25023/
Restart Required: Yes
Instructions:
1. Open Zoom Workplace on Linux. 2. Click your profile picture. 3. Select 'Check for Updates'. 4. Install version 6.4.13 or later. 5. Restart Zoom Workplace.
🔧 Temporary Workarounds
Network Segmentation
allRestrict Zoom traffic to trusted networks only
Certificate Pinning
allImplement certificate pinning at network level if supported
🧯 If You Can't Patch
- Use Zoom web client instead of desktop application for critical meetings
- Avoid using Zoom on untrusted or public networks until patched
🔍 How to Verify
Check if Vulnerable:
Check Zoom version in Settings > About. If version is below 6.4.13, system is vulnerable.Check Version:
zoom --version 2>/dev/null || dpkg -l | grep zoom || rpm -qa | grep -i zoomVerify Fix Applied:
Confirm Zoom version is 6.4.13 or higher in Settings > About.📡 Detection & Monitoring
Log Indicators:
- Certificate validation errors in Zoom logs
- Unexpected certificate authorities in TLS handshakes
Network Indicators:
- Man-in-the-middle detection alerts
- Unexpected certificate chains in Zoom traffic
SIEM Query:
source="zoom" AND (certificate_validation_failure OR ssl_error)