CVE-2023-28802: Disable Zscaler using machine tunnel restart
Published Nov 21, 2023
·Updated
An Improper Validation of Integrity Check Value in Zscaler Client Connector on Windows allows an authenticated user to disable ZIA/ZPA by interrupting the service restart from Zscaler Diagnostics. This issue affects Client Connector: before 4.2.0.149.
Affected Software
1 affected component
Zscaler Client Connector Windows<4.2.0.149
Event History
Nov 21, 2023
CVE Published
via MITRE·10:51 AM
Data Sourced
via MITRE·10:51 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·11:15 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2023-28802.
2
How can an authenticated user disable ZIA/ZPA?
An authenticated user can disable ZIA/ZPA by interrupting the service restart from Zscaler Diagnostics.
3
Which version of Zscaler Client Connector is affected?
Zscaler Client Connector versions before 4.2.0.149 are affected.
4
What is the severity rating of this vulnerability?
This vulnerability has a severity rating of medium (5.4).
5
Is there a fix available for this vulnerability?
Yes, updating Zscaler Client Connector to version 4.2.0.149 or later will fix this vulnerability.