Zoom Detects Vulnerability Giving Full Access to Hackers, Releases Patch

Update October 18, 2022: The American video conferencing company, Zoom, has released a new patch for macOS users to mitigate the CVE-2022-28762 vulnerability having a CVSS severity score of 7.3/10. The vulnerability affects the Zoom Client for Meetings, and exclusively exists on macOS versions 5.10.6 and prior to 5.12.0. It allows threat actors to exploit a port misconfiguration. The exploitation can be initiated by third-party members while using the Zoom App Layers API on the Zoom client because the threat actors could use this debugging port to control and exploit the Zoom Apps running in the Zoom client.

Earlier, the communications platform had reported a new vulnerability on its On-Premise Meeting Connector. The On-Premise Meeting Connector or On-prem is a paid tool for Zoom that enables users to host unlimited meetings and leverage additional customizations, personal meeting IDs, and much more.

The company’s Offensive Security Team recorded the vulnerability in the previous version (4.8.20220815.130) of MRR, which allows threat actors to gain improper control over the meetings.

Zoom On-Premise Meeting Connector vulnerability

On October 11, 2022, Zoom released an update on the vulnerability and marked it on the severity scale as “Medium.” According to the company, the vulnerability allows hackers and threat actors to steal audio and video feed inside a meeting — even though they are not a part of the organization or are not authorized to view the content. The CVE deployment given to the vulnerability is CVE-2022-28761, with a score of 6.5.

The vulnerability can also allow cyber criminals to steal exchanged data and insights from an organization and use it for blackmailing and phishing campaigns.

In response to the vulnerability, Zoom shared a quick method to update the virtual appliance so that the latest patch can be added to the application. Here’s how to mitigate the CVE-2022-28761 vulnerability and possibly update the virtual appliance

Zoom On-Premise Meeting Connector, how to update the latest patch?

Before updating to the latest version, users are requested to make sure they complete the prerequisites for updating the appliance. This includes “A running Meeting Connector or Virtual Room Connector” and “admin access to the server web interface.” Once these two requirements are sorted, here’s how to update a virtual appliance on the web console interface.

1. Open Google Chrome, Mozilla Firefox, or any other web browser currently installed on your PC.
2. In the search bar, type https://IPaddress:5480 and hit enter.
3. Now, sign in with admin credentials.
4. On the next page, go to the navigation menu and click on Update.
5. Click ‘Check for Updates.
6. On the next screen, check if any updates are available.
7. The appliance will start the download and installation process.
8. Once installation is complete, the device will automatically restart.
9. Sign back into the web console to confirm the update.
10. Finally, to complete the process, click on Dashboard and verify the ‘zctrl’ and ‘MMR’ processes are running.