CVE-2023-49647

Published: Jan 12, 2024Modified: Jun 17, 2026

7.8

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: NVD

Description

Improper access control in Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom SDKs for Windows before version 5.16.10 may allow an authenticated user to conduct an escalation of privilege via local access.

Affected (6)

Products: Zoom: Meeting Software Development Kit, Video Software Development Kit, Zoom, Virtual Desktop Infrastructure

Zoom

4 products

Meeting Software Development Kit

Video Software Development Kit

Zoom

Virtual Desktop Infrastructure

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Zoom Meeting Software Development Kit	Before 5.16.10
Zoom Video Software Development Kit	Before 5.16.10
Zoom Zoom	Before 5.16.10

Configuration B

3 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zoom Virtual Desktop Infrastructure	Before 5.14.14
Zoom Virtual Desktop Infrastructure	From 5.15.0 to 5.15.12
Zoom Virtual Desktop Infrastructure	From 5.16.0 to 5.16.10

Running on/with	Platform Versions
Microsoft Windows	All versions

Related CWEs

CWE-266

Incorrect Privilege Assignment

A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.

References (2)

https://www.zoom.com/en/trust/security-bulletin/ZSB-24001/

Source: security@zoom.us

Vendor Advisory

https://www.zoom.com/en/trust/security-bulletin/ZSB-24001/

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.