# MA-1033.022024: MyCERT Advisory - High-Severity Vulnerability in Zoom Products

**Date:** 17 Feb 2024  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-1033.022024  
**Advisory ID:** MA-1033.022024

---

**1.0 Introduction**
Recently, Zoom has released security updates to address the multiple vulnerabilities affecting various Zoom products. The vulnerabilities range from Medium to Critical and could be exploited by attackers to gain unauthorized access, escalate privileges, or execute arbitrary code on the affected system.
**2.0 Impact**
A remote attacker could exploit some of these vulnerabilities to trigger denial of service condition, elevation of privilege and sensitive information disclosure on the targeted system.
**3.0 Affected Products**
- Zoom Desktop Client for Linux before version 5.16.5
- Zoom Desktop Client for Linux before version 5.17.0
- Zoom Desktop Client for Windows before version 5.16.5
- Zoom Desktop Client for Windows before version 5.17.0
- Zoom Desktop Client for macOS before version 5.16.5
- Zoom Desktop Client for macOS before version 5.17.0
- Zoom Meeting SDK for Windows before version 5.16.5
- Zoom Meeting SDK for Windows before version 5.17.0
- Zoom Meeting SDKs before version 5.16.5
- Zoom Meeting SDKs before version 5.17.0
- Zoom Mobile App for Android before version 5.16.5
- Zoom Mobile App for Android before version 5.17.0
- Zoom Mobile App for iOS before version 5.16.5
- Zoom Mobile App for iOS before version 5.17.0
- Zoom Rooms Client for Windows before version 5.17.0
- Zoom Rooms Clients before version 5.17.0
- Zoom VDI Client for Windows before version 5.16.10 (excluding 5.14.14 and 5.15.12)
- Zoom VDI Client for Windows before version 5.17.5 (excluding 5.15.15 and 5.16.10)
- Zoom VDI Client for Windows before version 5.17.5 (excluding 5.15.15 and 5.16.12)
- Zoom Video SDK for Windows before version 5.16.5
**4.0 CVE Details**
|  |
| --- | --- | --- | CVE | Severity | Description | CVE-2024-24691 | Critical | Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for Windows - Improper Input Validation | CVE-2024-24697 | High | Zoom Clients - Untrusted Search Path | CVE-2024-24690 | Medium | Zoom Clients - Improper Input Validation | CVE-2024-24699 | Medium | Zoom Clients - Business Logic Error | CVE-2024-24698 | Medium | Zoom Clients - Improper Authentication | CVE-2024-24696 | Medium | Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for Windows - Improper Input Validation | CVE-2024-24695 | Medium | Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for Windows - Improper Input Validation |
**5.0 Recommendations**
Users and system administrators are encouraged to review the [Zoom Security Bulletin](https://www.zoom.com/en/trust/security-bulletin/) and upgrade to the latest version.
Kindly refer to the URL for more information:
- CVE-2024-24690: <https://www.zoom.com/en/trust/security-bulletin/ZSB-24007/>
- CVE-2024-24691: <https://www.zoom.com/en/trust/security-bulletin/ZSB-24008/>
- CVE-2024-24695: <https://www.zoom.com/en/trust/security-bulletin/ZSB-24002/>
- CVE-2024-24696: <https://www.zoom.com/en/trust/security-bulletin/ZSB-24003/>
- CVE-2024-24697: <https://www.zoom.com/en/trust/security-bulletin/ZSB-24004/>
- CVE-2024-24698: <https://www.zoom.com/en/trust/security-bulletin/ZSB-24005/>
- CVE-2024-24699: <https://www.zoom.com/en/trust/security-bulletin/ZSB-24006/>
Generally, CyberSecurity Malaysia advises the users to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact us through the following channels:
E-mail: cyber999[at]cybersecurity.my 
Phone: 1-300-88-2999 (monitored during business hours) 
Mobile: +60 19 2665850 (24x7 call incident reporting) 
Business Hours: Mon - Fri 09:00 -18:00 MYT 
Web: [https://www.mycert.org.my](https://www.mycert.org.my/) 
Twitter: <https://twitter.com/mycert> 
Facebook: <https://www.facebook.com/mycert.org.my>
**6.0    References**
- <https://www.zoom.com/en/trust/security-bulletin/ZSB-24008/>
- <https://www.zoom.com/en/trust/security-bulletin/ZSB-24007/>
- <https://www.zoom.com/en/trust/security-bulletin/ZSB-24006/>
- <https://www.zoom.com/en/trust/security-bulletin/ZSB-24005/>
- <https://www.zoom.com/en/trust/security-bulletin/ZSB-24004/>
- <https://www.zoom.com/en/trust/security-bulletin/ZSB-24004/>
- <https://www.zoom.com/en/trust/security-bulletin/ZSB-24002/>
- <https://www.hkcert.org/security-bulletin/zoom-products-multiple-vulnerabilities_20240214>