CVE-2025-64741
📋 TL;DR
An improper authorization vulnerability in Zoom Workplace for Android allows unauthenticated attackers with network access to escalate privileges. This affects all Android users running Zoom Workplace versions before 6.5.10. Attackers could potentially gain unauthorized access to sensitive app functions.
💻 Affected Systems
- Zoom Workplace for Android
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of Zoom Workplace app data and functionality, potentially accessing sensitive meeting information, contacts, or device resources.
Likely Case
Unauthorized access to app features or data that should require authentication, potentially exposing user information or enabling further attacks.
If Mitigated
Limited impact with proper network segmentation and updated app versions, restricting attacker access to vulnerable endpoints.
🎯 Exploit Status
CWE-74 indicates improper input validation/neutralization, suggesting potential for crafted network requests to bypass authorization.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 6.5.10
Vendor Advisory: https://www.zoom.com/en/trust/security-bulletin/zsb-25043
Restart Required: Yes
Instructions:
1. Open Google Play Store 2. Search for Zoom Workplace 3. Update to version 6.5.10 or later 4. Restart the app
🔧 Temporary Workarounds
Network Segmentation
allRestrict network access to Android devices running Zoom Workplace
App Removal
androidTemporarily remove Zoom Workplace from vulnerable devices
🧯 If You Can't Patch
- Disable Zoom Workplace app on affected devices
- Implement strict network access controls to limit exposure
🔍 How to Verify
Check if Vulnerable:
Check Zoom Workplace app version in Android Settings > Apps > Zoom WorkplaceCheck Version:
Not applicable for Android apps (check via device settings)Verify Fix Applied:
Confirm app version is 6.5.10 or higher in app settings📡 Detection & Monitoring
Log Indicators:
- Unusual authentication bypass attempts
- Unexpected privilege escalation events
Network Indicators:
- Suspicious network traffic to Zoom Workplace app ports
- Unauthorized API calls
SIEM Query:
Not provided in advisory