Skip to content
OpenAdvisories
High WID-SEC-2025-2541 9 CVEs

Zoom Video Communications Workplace und Rooms: Mehrere Schwachstellen

Published Nov 10, 2025 · Updated Nov 13, 2025 · Revision 2 · de-DE

Vendor: Zoom Video Communications Product: Rooms Product: Workplace Platform: Android Platform: macOS Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Zoom Video Communications Workplace und Zoom Video Communications Rooms ausnutzen, um seine Privilegien zu erhöhen, Cross-Site-Scripting-Angriffe durchzuführen oder vertrauliche Informationen offenzulegen.

Product

Zoom Workplace ist eine Plattform, die Videokonferenz-, Chat-, Telefon- und Collaboration-Tools integriert, um Remote- und Hybrid-Arbeitsumgebungen in Unternehmen zu unterstützen.
Zoom Rooms ist ein softwarebasiertes Raumsystem, das integrierte Audiokonferenzen, drahtlose Bildschirmfreigabe und Videokonferenzen ermöglicht.

Vulnerabilities 9

  • High 8.1
    CVE-2025-62484

    Zoom Workplace Clients - Inefficient Regular Expression Complexity

    Inefficient regular expression complexity in certain Zoom Workplace Clients before version 6.5.10 may allow an unauthenticated user to conduct an escalation of privilege via network access.

    Zoom Communications Zoom Workplace
  • High 8.1
    CVE-2025-64741

    Zoom Workplace for Android - Improper Authorization Handling

    Improper authorization handling in Zoom Workplace for Android before version 6.5.10 may allow an unauthenticated user to conduct an escalation of privilege via network access.

    Zoom Communications Zoom Workplace for Android Android
  • High 7.5
    CVE-2025-64740

    Zoom Workplace VDI Client for Windows - Improper Verification of Cryptographic Signature

    Improper verification of cryptographic signature in the installer for Zoom Workplace VDI Client for Windows may allow an authenticated user to conduct an escalation of privilege via local access.

    Zoom Communications Zoom Workplace VDI Client
  • Medium 6.6
    CVE-2025-30662

    Zoom Workplace VDI Plugin macOS Universal Installer - Symlink Following

    Symlink following in the installer for the Zoom Workplace VDI Plugin macOS Universal installer before version 6.3.14, 6.4.14, and 6.5.10 in their respective tracks may allow an authenticated user to conduct a disclosure of information via network access.

    Zoom Communications Zoom Workplace VDI Plugin macOS Universal installer macOS
  • Medium 5.3
    CVE-2025-62483

    Zoom Clients - Improper Removal of Sensitive Information

    Improper removal of sensitive information in certain Zoom Clients before version 6.5.10 may allow an unauthenticated user to conduct a disclosure of information via network access.

    Zoom Communications Zoom Clients
  • Medium 5.0
    CVE-2025-64738

    Zoom Workplace for macOS - External Control of File Name or Path

    External control of file name or path in Zoom Workplace for macOS before version 6.5.10 may allow an authenticated user to conduct a disclosure of information via local access.

    Zoom Communications Zoom Workplace for macOS macOS
  • Medium 4.8
    CVE-2025-30669

    Zoom Workplace Clients - Improper Certificate Validation

    Improper certificate validation in certain Zoom Clients may allow an unauthenticated user to conduct a disclosure of information via adjacent access.

    Zoom Communications Zoom Workplace Clients
  • Medium 4.3
    CVE-2025-62482

    Zoom Workplace for Windows - Cross-site Scripting

    Cross-site scripting in Zoom Workplace for Windows before version 6.5.10 may allow an unauthenticated user to impact integrity via network access.

    Zoom Communications Zoom Workplace
  • Medium 4.3
    CVE-2025-64739

    Zoom Clients - External Control of File Name or Path

    External control of file name or path in certain Zoom Clients may allow an unauthenticated user to conduct a disclosure of information via network access.

    Zoom Communications Zoom Clients

Revision history

  1. #2

    Referenz(en) aufgenommen: EUVD-2025-175325, EUVD-2025-175306, EUVD-2025-175323, EUVD-2025-175318, EUVD-2025-175320, EUVD-2025-175307, EUVD-2025-175321, EUVD-2025-175326, EUVD-2025-175317

  2. #1

    Initiale Fassung

References