CVE-2022-36925: Zoom Rooms for macOS clients before version 5.11.4 contain an insecure key generation mechanism. The encryption key used for IPC between the Zoom Rooms daemon…

PriorityP336high7.8CVSS 3.1

AVLACLPRLUINSUCHIHAH

EPSS

0.12%

2.1th percentile

Zoom Rooms for macOS clients before version 5.11.4 contain an insecure key generation mechanism. The encryption key used for IPC between the Zoom Rooms daemon service and the Zoom Rooms client was generated using parameters that could be obtained by a local low-privileged application. That key can then be used to interact with the daemon service to execute privileged functions and cause a local denial of service.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
zoom	rooms	< 5.11.4	5.11.4
zoom_video_communications_inc	zoom_rooms_for_macos	>= unspecified < 5.11.4	5.11.4

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.