Zoom On-Premise Deployments: Stack Buffer Overflow in Meeting Connector
Priority MEDIUM 46CWE-121Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-121 and the CVSS impact.
Summary
Zoom On-Premise Meeting Connector Zone Controller (ZC) before version 4.8.20220419.112 fails to properly parse STUN error codes, which can result in memory corruption and could allow a malicious actor to crash the application. In versions older than 4.8.12.20211115, this vulnerability could also be leveraged to execute arbitrary code.
Why it matters now
EPSS 0.02157 82nd percentileScored 2026-11-07
Fix Fixed Zoom On-Premise Meeting Connector Zone Controller (ZC) (Zoom Video Communications Inc): 4.8.20220419.112
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Zoom Video Communications, Inc. | Zoom On-Premise Meeting Connector Zone Controller (ZC) | before 4.8.20220419.112 | 4.8.20220419.112 | Patch available | CNA |
- Zoom On-Premise Meeting Connector Zone Controller (ZC) VendorZoom Video Communications, Inc. Affected before 4.8.20220419.112 Fixed in 4.8.20220419.112 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:zoom:meeting_connector:*:*:*:*:*:*:*:* | before 4.8.20220419.112 | Vulnerable | Zoom Video Communications, Inc. |
- cpe:2.3:a:zoom:meeting_connector:*:*:*:*:*:*:*:* Versions before 4.8.20220419.112 Vulnerable ·Zoom Video Communications, Inc.
Remediation
- Fix · CNA Zoom On-Premise Meeting Connector Zone Controller (ZC) (Zoom Video Communications Inc) Fixed in 4.8.20220419.112
Timeline
- 2026-10-02 Threatist record created from CVE-2022-28750
- 2026-10-03 Alias added: GHSA-2597-6hvw-h9cx
References
More Zoom Video Communications, Inc. Meeting Connector vulnerabilities
- TI-2021-13450 Improper input validation in Zoom On-Premise Meeting Connector Controller, Zoom… CVSS 3.1CRITICAL 9.8
- TI-2021-13449 Resource allocation without limits in Zoom On-Premise Meeting Connector Controller CVSS 3.1HIGH 7.5
- TI-2021-13448 Improper input validation in Zoom on-premise Meeting Connector Controller, Zoom… CVSS 3.1HIGH 7.2
- TI-2022-11384 Zoom On-Premise Deployments: Improper Access Control Vulnerability CVSS 3.1HIGH 7.1
- TI-2022-11383 Zoom On-Premise Deployments: Improper Access Control Vulnerability CVSS 3.1HIGH 7.1
Sources
- CVE-2022-28750 · CVE Program
- CVE-2022-28750 · NVD
- FIRST EPSS
- GHSA-2597-6hvw-h9cx · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences