CVE-2025-62482
📋 TL;DR
A cross-site scripting vulnerability in Zoom Workplace for Windows allows unauthenticated attackers to inject malicious scripts via network access. This could enable session hijacking, data theft, or redirection to malicious sites. All Windows users running Zoom Workplace versions before 6.5.10 are affected.
💻 Affected Systems
- Zoom Workplace
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal session cookies, credentials, or sensitive data from users' Zoom sessions, potentially leading to account compromise or data exfiltration.
Likely Case
Attackers inject malicious scripts that redirect users to phishing sites, display fake login prompts, or steal session information.
If Mitigated
With proper input validation and output encoding, the impact is limited to minor UI manipulation with no data compromise.
🎯 Exploit Status
Exploitation requires network access to the target system and user interaction with malicious content.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 6.5.10
Vendor Advisory: https://www.zoom.com/en/trust/security-bulletin/zsb-25046
Restart Required: Yes
Instructions:
1. Open Zoom Workplace. 2. Click your profile picture. 3. Select 'Check for Updates'. 4. Install version 6.5.10 or later. 5. Restart the application.
🔧 Temporary Workarounds
Disable JavaScript in Zoom
windowsPrevents script execution but may break legitimate functionality
Network Segmentation
allRestrict network access to Zoom Workplace endpoints
🧯 If You Can't Patch
- Implement web application firewall with XSS filtering rules
- Educate users to avoid clicking suspicious links in Zoom
🔍 How to Verify
Check if Vulnerable:
Check Zoom Workplace version in Settings > AboutCheck Version:
Not applicable - check via Zoom GUI Settings > AboutVerify Fix Applied:
Confirm version is 6.5.10 or higher in Settings > About📡 Detection & Monitoring
Log Indicators:
- Unusual script tags or JavaScript in Zoom network traffic
- Multiple redirects from Zoom sessions
Network Indicators:
- Suspicious script injection patterns in HTTP requests to Zoom endpoints
- Unexpected external resource loads from Zoom sessions
SIEM Query:
source="zoom" AND (http_uri CONTAINS "<script>" OR http_uri CONTAINS "javascript:")