High severity · published Apr 9, 2021
CVE-2021-30480
Zoom Chat through 2021-04-09 on Windows and macOS allows certain remote authenticated attackers to execute arbitrary code without user interaction
8.8
CVSS
5.8%
EPSS
No
On KEV
Description
Zoom Chat through 2021-04-09 on Windows and macOS allows certain remote authenticated attackers to execute arbitrary code without user interaction. An attacker must be within the same organization, or an external party who has been accepted as a contact. NOTE: this is specific to the Zoom Chat software, which is different from the chat feature of the Zoom Meetings and Zoom Video Webinars software.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)5.8% · higher than 93% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CH
Chat · Zoom
through 2021-04-09 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-30480
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-30480
Third Party Advisory
https://blog.malwarebytes.com/exploits-and-vulnerabilities/2021/04/zoom-zero-day-discovery-makes-calls-safer-hackers-200000-richer/
Vendor Advisory
https://explore.zoom.us/en/trust/security/security-bulletin/
Exploit
https://sector7.computest.nl/post/2021-08-zoom/
Third Party Advisory
https://twitter.com/thezdi/status/1379855435730149378
Third Party Advisory
https://twitter.com/thezdi/status/1379859851061395459
Press/Media Coverage
https://www.securityweek.com/200000-awarded-zero-click-zoom-exploit-pwn2own