High severity · published May 1, 2024
CVE-2024-23457
Anti-tampering can be disabled with uninstall password enforced
7.8
CVSS
0.2%
EPSS
No
On KEV
Description
The anti-tampering functionality of the Zscaler Client Connector can be disabled under certain conditions when an uninstall password is enforced. This affects Zscaler Client Connector on Windows prior to 4.2.0.209
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 10% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CC
Client Connector · Zscaler
before 4.2.0.209 · source: vendor, NVD, CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-23457
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-23457
Release Notes
https://help.zscaler.com/client-connector/client-connector-app-release-summary-2023
More from Client Connector
9.8
CVE-2024-23483
Local Privilege Escalation via lack of input validation
9.8
CVE-2024-23459
Multiple Arbitrary Creates/Overwrites by link following
9.8
CVE-2023-28798
Out-of-bounds write to heap in pacparser
9.8
CVE-2024-23480
Insecure MacOS code sign check fallback
9.8
CVE-2023-28805
ZCC on Linux privilege escalation