CVE-2022-28750 Zoom On-Premise Deployments: Stack Buffer Overflow in Meeting Connector
A stack buffer overflow in Zoom On-Premise Meeting Connector allows attackers to execute arbitrary code or crash the application via malformed STUN packets.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-28750?
CVE-2022-28750 is a high-severity memory corruption vulnerability in Zoom On-Premise Meeting Connector Zone Controller (ZC), published on 11 Aug 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Zoom On-Premise Meeting Connector Zone Controller (ZC) before version 4.8.20220419.112 fails to properly parse STUN error codes, which can result in memory corruption and could allow a malicious actor to crash the application. In versions older than 4.8.12.20211115, this vulnerability could also be leveraged to execute arbitrary code.
Which versions are affected by CVE-2022-28750?
It affects 1 product.
Products include Zoom Meeting Connector.
How do I fix CVE-2022-28750?
No fix has been published for CVE-2022-28750 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2022-28750 being exploited?
There is no known exploitation of CVE-2022-28750 in the wild and no public exploit code.
Other vulnerabilities in Zoom On-Premise Meeting Connector Zone Controller (ZC)
- CVE-2021-34416 Command injection in Zoom On-Premise Meeting Connector Controller, Zoom On-Premise Meeting Connector MMR, Zoom On-Premise Recording Connector, Zoom On-Premise Virtual Room Connector, Zoom On-Premise Virtual Room Connector Load Balancer
- CVE-2021-34415 Denial of service in Zoom On-Premise Meeting Connector Controller
- CVE-2021-34414 Command injection in Zoom on-premise Meeting Connector Controller, Zoom on-premise Meeting Connector MMR, Zoom on-premise Recording Connector, Zoom on-premise Virtual Room Connector, Zoom on-premise Virtual Room Connector Load Balancer
- CVE-2022-28753 Zoom On-Premise Deployments: Improper Access Control Vulnerability
- CVE-2022-28754 Zoom On-Premise Deployments: Improper Access Control Vulnerability
Sources
Also known as GHSA-2597-6hvw-h9cx.