What happened
A vulnerability has been identified in Zoom Workplace for Android versions prior to 7.2.1. The flaw involves improper authorization in the handler for a custom URL scheme, which may enable an unauthenticated user to escalate privileges through network access. This vulnerability has been classified as high severity, with a CVSS score of 8.1. due to its potential for privilege escalation without user interaction.
Exploitation requires an attacker to access an exposed network service used by affected deployments. The attacker can directly target this service without any involvement from a user, making the vulnerability particularly concerning for organisations with network exposure to such services. The vulnerability exists within the application’s handling of custom URL schemes, which can be exploited if the service is reachable from the internet or insufficiently protected network segments.
The vulnerability is associated with CWE-939 and is still under review by the National Vulnerability Database (NVD), which may lead to scope adjustments or further details. At the time of this advisory, no patches or updates are available to remediate the flaw.
Who is affected
Organisations running affected versions of Zoom Workplace for Android before 7.2.1 are impacted by this vulnerability. Any deployment with network services exposed externally or with inadequate network segmentation is at increased risk of exploitation. Since the issue involves network access with low privilege requirements, the concern is primarily for deployments with insufficient controls on network perimeter or internal segmentation.
Recommended actions
Implement network segmentation and access controls to restrict external access to services identified as vulnerable, especially those related to Zoom Workplace.
Review network configurations to ensure that exposed services are secured against unauthenticated access attempts.
Monitor network traffic for unusual activity targeting the affected services or known attack vectors related to this vulnerability.
Stay informed on updates from the vendor regarding patches or security advisories related to affected versions.
