Authenticated remote command execution with root privileges via web console in MMR
Priority LOW 37CWE-20Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
The network proxy page on the web portal for the Zoom On-Premise Meeting Connector Controller before version 4.6.365.20210703, Zoom On-Premise Meeting Connector MMR before version 4.6.365.20210703, Zoom On-Premise Recording Connector before version 3.8.45.20210703, Zoom On-Premise Virtual Room Connector before version 4.4.6868.20210703, and Zoom On-Premise Virtual Room Connector Load Balancer before version 2.5.5496.20210703 fails to validate input sent in requests to set the network proxy password. This could lead to remote command injection by a web portal administrator.
Why it matters now
EPSS 0.01238 69th percentileScored 2026-11-07
Fix Fixed Zoom On-Premise Meeting Connector Controller (Zoom Video Communications Inc): 4.6.365.20210703Zoom On-Premise Meeting Connector MMR (Zoom Video Communications Inc): 4.6.365.20210703+3 more products
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Zoom Video Communications, Inc. | Zoom On-Premise Meeting Connector Controller | before 4.6.365.20210703 | 4.6.365.20210703 | Patch available | CNA |
| Zoom Video Communications, Inc. | Zoom On-Premise Meeting Connector MMR | before 4.6.365.20210703 | 4.6.365.20210703 | Patch available | CNA |
| Zoom Video Communications, Inc. | Zoom On-Premise Recording Connector | before 3.8.45.20210703 | 3.8.45.20210703 | Patch available | CNA |
| Zoom Video Communications, Inc. | Zoom On-Premise Virtual Room Connector | before 4.4.6868.20210703 | 4.4.6868.20210703 | Patch available | CNA |
| Zoom Video Communications, Inc. | Zoom On-Premise Virtual Room Connector Load Balancer | before 2.5.5496.20210703 | 2.5.5496.20210703 | Patch available | CNA |
- Zoom On-Premise Meeting Connector Controller VendorZoom Video Communications, Inc. Affected before 4.6.365.20210703 Fixed in 4.6.365.20210703 Patch available CNA
- Zoom On-Premise Meeting Connector MMR VendorZoom Video Communications, Inc. Affected before 4.6.365.20210703 Fixed in 4.6.365.20210703 Patch available CNA
- Zoom On-Premise Recording Connector VendorZoom Video Communications, Inc. Affected before 3.8.45.20210703 Fixed in 3.8.45.20210703 Patch available CNA
- Zoom On-Premise Virtual Room Connector VendorZoom Video Communications, Inc. Affected before 4.4.6868.20210703 Fixed in 4.4.6868.20210703 Patch available CNA
- Zoom On-Premise Virtual Room Connector Load Balancer VendorZoom Video Communications, Inc. Affected before 2.5.5496.20210703 Fixed in 2.5.5496.20210703 Patch available CNA
CPE configurations NVD · 5
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:zoom:zoom_on-premise_meeting_connector_controller:*:*:*:*:*:*:*:* | before 4.6.365.20210703 | Vulnerable | Zoom Video Communications, Inc. |
| cpe:2.3:a:zoom:zoom_on-premise_meeting_connector_mmr:*:*:*:*:*:*:*:* | before 4.6.365.20210703 | Vulnerable | Zoom Video Communications, Inc. |
| cpe:2.3:a:zoom:zoom_on-premise_recording_connector:*:*:*:*:*:*:*:* | before 3.8.45.20210703 | Vulnerable | Zoom Video Communications, Inc. |
| cpe:2.3:a:zoom:zoom_on-premise_virtual_room_connector:*:*:*:*:*:*:*:* | before 4.4.6868.20210703 | Vulnerable | Zoom Video Communications, Inc. |
| cpe:2.3:a:zoom:zoom_on-premise_virtual_room_connector_load_balancer:*:*:*:*:*:*:*:* | before 2.5.5496.20210703 | Vulnerable | Zoom Video Communications, Inc. |
- cpe:2.3:a:zoom:zoom_on-premise_meeting_connector_controller:*:*:*:*:*:*:*:* Versions before 4.6.365.20210703 Vulnerable ·Zoom Video Communications, Inc.
- cpe:2.3:a:zoom:zoom_on-premise_meeting_connector_mmr:*:*:*:*:*:*:*:* Versions before 4.6.365.20210703 Vulnerable ·Zoom Video Communications, Inc.
- cpe:2.3:a:zoom:zoom_on-premise_recording_connector:*:*:*:*:*:*:*:* Versions before 3.8.45.20210703 Vulnerable ·Zoom Video Communications, Inc.
- cpe:2.3:a:zoom:zoom_on-premise_virtual_room_connector:*:*:*:*:*:*:*:* Versions before 4.4.6868.20210703 Vulnerable ·Zoom Video Communications, Inc.
- cpe:2.3:a:zoom:zoom_on-premise_virtual_room_connector_load_balancer:*:*:*:*:*:*:*:* Versions before 2.5.5496.20210703 Vulnerable ·Zoom Video Communications, Inc.
Remediation
- Fix · CNA Zoom On-Premise Meeting Connector Controller (Zoom Video Communications Inc) Fixed in 4.6.365.20210703
- Fix · CNA Zoom On-Premise Meeting Connector MMR (Zoom Video Communications Inc) Fixed in 4.6.365.20210703
- Fix · CNA Zoom On-Premise Recording Connector (Zoom Video Communications Inc) Fixed in 3.8.45.20210703
- Fix · CNA Zoom On-Premise Virtual Room Connector (Zoom Video Communications Inc) Fixed in 4.4.6868.20210703
- Fix · CNA Zoom On-Premise Virtual Room Connector Load Balancer (Zoom Video Communications Inc) Fixed in 2.5.5496.20210703
Timeline
- 2026-10-02 Threatist record created from CVE-2021-34417
- 2026-10-03 Alias added: GHSA-qq47-rh4x-g9mg
References
More Zoom Video Communications, Inc. Zoom On-premise Meeting Connector Controller vulnerabilities
- TI-2021-13457 Buffer overflow in Zoom client and other products CVSS 3.1CRITICAL 9.8
- TI-2021-13458 Process memory exposure in Zoom Client and other products CVSS 3.1HIGH 7.5
- TI-2022-07032 Process memory exposure in Zoom on-premise Meeting services CVSS 3.1HIGH 7.5
- TI-2021-13452 Pre-auth Null pointer crash in on-premise web console CVSS 3.1MEDIUM 5.3
Sources
- CVE-2021-34417 · CVE Program
- CVE-2021-34417 · NVD
- FIRST EPSS
- GHSA-qq47-rh4x-g9mg · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences