Paper/Archive/CVE-2022-28750

CVE-2022-28750

Zoom Video Communications Inc Zoom On-Premise Meeting Connector Zone Controller (ZC) — Zoom On-Premise Deployments: Stack Buffer Overflow in Meeting Connector

EPSS 2%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (NVD)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 82.2.822 × 2016.4 No public exploit+100.0 SSVC exploitation: unknown+100.0

Description · from the CVE record

Zoom On-Premise Meeting Connector Zone Controller (ZC) before version 4.8.20220419.112 fails to properly parse STUN error codes, which can result in memory corruption and could allow a malicious actor to crash the application. In versions older than 4.8.12.20211115, this vulnerability could also be leveraged to execute arbitrary code.

Affected

ProductAffectedFixed inSource

Zoom On-Premise Meeting Connector Zone Controller (ZC)unspecified – < 4.8.20220419.1124.8.20220419.112CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Zoom (CNA)7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

refexplore.zoom.us/en/trust/security/security-bulletin