High severity · published Sep 27, 2021
CVE-2021-34414
The network proxy page on the web portal for the Zoom on-premise Meeting Connector Controller before version 4.6.348.20201217, Zoom on-premise Meeting Connector MMR before version…
7.2
CVSS
1.5%
EPSS
No
On KEV
Description
The network proxy page on the web portal for the Zoom on-premise Meeting Connector Controller before version 4.6.348.20201217, Zoom on-premise Meeting Connector MMR before version 4.6.348.20201217, Zoom on-premise Recording Connector before version 3.8.42.20200905, Zoom on-premise Virtual Room Connector before version 4.4.6620.20201110, and Zoom on-premise Virtual Room Connector Load Balancer before version 2.5.5495.20210326 fails to validate input sent in requests to update the network proxy configuration, which could lead to remote command injection on the on-premise image by a web portal administrator.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.5% · higher than 74% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MC
Meeting Connector · Zoom
before 4.6.348.20201217 · source: NVD
RC
Recording Connector · Zoom
before 3.8.42.20200905 · source: NVD
VR
Virtual Room Connector · Zoom
before 4.4.6620.20201110 · source: NVD
VR
Virtual Room Connector Load Balancer · Zoom
before 2.5.5495.20210326 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-34414
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-34414
Vendor Advisory
https://explore.zoom.us/en/trust/security/security-bulletin/
More from Meeting Connector
9.8
CVE-2022-28750
Zoom On-Premise Meeting Connector Zone Controller (ZC) before version 4.8.20220419.112 fails to properly parse STUN error codes, which can result in memory corruption and could…
9.8
CVE-2021-34416
The network address administrative settings web portal for the Zoom on-premise Meeting Connector before version 4.6.360.20210325, Zoom on-premise Meeting Connector MMR before…
7.5
CVE-2021-34415
The Zone Controller service in the Zoom On-Premise Meeting Connector Controller before version 4.6.358.20210205 does not verify the cnt field sent in incoming network packets,…
5.4
CVE-2022-28754
Zoom On-Premise Meeting Connector MMR before version 4.8.129.20220714 contains an improper access control vulnerability
5.4
CVE-2022-28753
Zoom On-Premise Meeting Connector MMR before version 4.8.129.20220714 contains an improper access control vulnerability