Vulnerability Details : CVE-2021-34420
The Zoom Client for Meetings for Windows installer before version 5.5.4 does not properly verify the signature of files with .msi, .ps1, and .bat extensions. This could lead to a malicious actor installing malicious software on a customer’s computer.
Products affected by CVE-2021-34420
- cpe:2.3:a:zoom:zoom_client_for_meetings:*:*:*:*:*:windows:*:*
Exploit prediction scoring system (EPSS) score for CVE-2021-34420
0.17%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 34 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2021-34420
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
4.3
|
MEDIUM | AV:N/AC:M/Au:N/C:N/I:P/A:N |
8.6
|
2.9
|
NIST | |
|
7.4
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N |
2.8
|
4.0
|
NIST | |
|
4.7
|
MEDIUM | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N |
2.8
|
1.4
|
Zoom Video Communications, Inc. |
CWE ids for CVE-2021-34420
-
The product does not verify, or incorrectly verifies, the cryptographic signature for data.Assigned by: nvd@nist.gov (Primary)
References for CVE-2021-34420
-
https://medium.com/manomano-tech/a-red-team-operation-leveraging-a-zero-day-vulnerability-in-zoom-80f57fb0822e
A Red Team Operation Leveraging a zero-day vulnerability in Zoom | by Laurent Delosieres | Manomano Tech | MediumThird Party Advisory
-
https://explore.zoom.us/en/trust/security/security-bulletin
Security Bulletin | ZoomVendor Advisory
Jump to