Improper trust boundary implementation for SMB in Zoom Clients

CVE-2023-28597

Summary

Zoom clients earlier than version 5.13.5 are impacted by a vulnerability related to improper trust boundary implementation. When users save local recordings to an SMB location and later access them via a link from the Zoom web portal, an attacker on an adjacent network may exploit this weakness. By establishing a malicious SMB server, the attacker can intercept client requests and inadvertently execute harmful executables on the client's device. This scenario poses significant risks, including unauthorized access to user data and the potential for remote code execution, highlighting the importance of maintaining up-to-date software for security.

References