CVE-2021-34416: Input Validation
First published: Mon Sep 27 2021(Updated: )
The network address administrative settings web portal for the Zoom on-premise Meeting Connector before version 4.6.360.20210325, Zoom on-premise Meeting Connector MMR before version 4.6.360.20210325, Zoom on-premise Recording Connector before version 3.8.44.20210326, Zoom on-premise Virtual Room Connector before version 4.4.6752.20210326, and Zoom on-premise Virtual Room Connector Load Balancer before version 2.5.5495.20210326 fails to validate input sent in requests to update the network configuration, which could lead to remote command injection on the on-premise image by the web portal administrators.
Credit: security@zoom.us
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Zoom Meeting Connector | <4.6.360.20210325 | |
| Zoom Recording Connector | <3.8.44.20210326 | |
| Zoom Virtual Room Connector | <4.4.6752.20210326 | |
| Zoom Zoom On-Premise Virtual Room Connector Load Balancer | <2.5.5495.20210326 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2021-34416?
CVE-2021-34416 has a high severity level due to the potential exposure of sensitive network settings.
How do I fix CVE-2021-34416?
To fix CVE-2021-34416, upgrade Zoom Meeting Connector, Recording Connector, and Virtual Room Connector to the latest versions provided by Zoom.
What is affected by CVE-2021-34416?
CVE-2021-34416 affects earlier versions of Zoom Meeting Connector, Recording Connector, and Virtual Room Connector before specified versions.
What types of attacks can exploit CVE-2021-34416?
CVE-2021-34416 can be exploited through unauthorized access to administrative settings, potentially leading to configuration modifications.
Is CVE-2021-34416 being actively exploited?
As of the latest reports, there are indications that CVE-2021-34416 could be exploited by malicious actors if the vulnerable software is not updated.
- agent/weakness
- agent/softwarecombine
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/references
- agent/author
- agent/last-modified-date
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/zoom
- canonical/zoom meeting connector
- canonical/zoom recording connector
- canonical/zoom virtual room connector
- canonical/zoom zoom on-premise virtual room connector load balancer