CVE-2021-34409 Zoom Client Installer Local Privilege Escalation

High 7.8 Published 27 Sep 2021 Updated 16 Sep 2024

Local attackers can escalate privileges by exploiting insecure file permissions in Zoom installer scripts to execute arbitrary commands.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2021-34409?

CVE-2021-34409 is a high-severity vulnerability in Zoom Rooms, published on 27 Sep 2021. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

It was discovered that the installation packages of the Zoom Client for Meetings for MacOS (Standard and for IT Admin) installation before version 5.2.0, Zoom Client Plugin for Sharing iPhone/iPad before version 5.2.0, and Zoom Rooms for Conference before version 5.1.0, copy pre- and post- installation shell scripts to a user-writable directory. In the affected products listed below, a malicious actor with local access to a user's machine could use this flaw to potentially run arbitrary system commands in a higher privileged context during the installation process.

Weakness: CWE-732

Which versions are affected by CVE-2021-34409?

It affects 3 products.

Products include Zoom Meetings, Zoom Rooms, Zoom Screen Sharing.

How do I fix CVE-2021-34409?

No fix has been published for CVE-2021-34409 yet. Limit exposure of the affected software until one is available.

Is CVE-2021-34409 being exploited?

There is no known exploitation of CVE-2021-34409 in the wild and no public exploit code.

All Zoom Rooms vulnerabilities

Sources

Also known as GHSA-qc3j-qcr3-434w.