CVE-2023-28597: Zoom clients prior to 5.13.5 contain an improper trust boundary implementation vulnerability. If a victim saves a local recording to an SMB location and later…

PriorityP343high7.5CVSS 3.1

AVAACHPRNUINSUCHIHAH

EPSS

0.52%

40.2th percentile

Zoom clients prior to 5.13.5 contain an improper trust boundary implementation vulnerability. If a victim saves a local recording to an SMB location and later opens it using a link from Zoom’s web portal, an attacker positioned on an adjacent network to the victim client could set up a malicious SMB server to respond to client requests, causing the client to execute attacker controlled executables. This could result in an attacker gaining access to a user's device and data, and remote code execution.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
zoom	rooms	< 5.13.5	5.13.5
zoom	virtual_desktop_infrastructure	< 5.13.10	5.13.10
zoom	zoom	< 5.13.5	5.13.5
zoom_video_communications_inc	zoom_vdi_for_windows	>= unspecified < 5.13.10	5.13.10

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.