TI-2023-13121 Aliases CVE-2023-28597 GHSA-xwf7-9xfx-ghmm

Improper trust boundary implementation for SMB in Zoom Clients

LOW 39CWE-501Published 2023-03-27 · Updated 2025-02-19

Key facts

Attack vector: Adjacent network
Privileges required: None
User interaction: None
Attack complexity: High
Impact type: —
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Zoom clients prior to 5.13.5 contain an improper trust boundary implementation vulnerability. If a victim saves a local recording to an SMB location and later opens it using a link from Zoom’s web portal, an attacker positioned on an adjacent network to the victim client could set up a malicious SMB server to respond to client requests, causing the client to execute attacker controlled executables. This could result in an attacker gaining access to a user's device and data, and remote code execution.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00521 44th percentileScored 2026-11-07

Fix Fixed Zoom (for Android, iOS, Linux, macOS, and Windows) (Zoom Video Communications Inc): 5.13.5Zoom Rooms (for Android, iOS, Linux, macOS, and Windows) (Zoom Video Communications Inc): 5.13.5+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Zoom Video Communications, Inc.	Zoom (for Android, iOS, Linux, macOS, and Windows)	before 5.13.5	5.13.5	Patch available	CNA
Zoom Video Communications, Inc.	Zoom Rooms (for Android, iOS, Linux, macOS, and Windows)	before 5.13.5	5.13.5	Patch available	CNA
Zoom Video Communications, Inc.	Zoom VDI for Windows	before 5.13.10	5.13.10	Patch available	CNA

Zoom (for Android, iOS, Linux, macOS, and Windows) VendorZoom Video Communications, Inc. Affected before 5.13.5 Fixed in 5.13.5 Patch available CNA
Zoom Rooms (for Android, iOS, Linux, macOS, and Windows) VendorZoom Video Communications, Inc. Affected before 5.13.5 Fixed in 5.13.5 Patch available CNA
Zoom VDI for Windows VendorZoom Video Communications, Inc. Affected before 5.13.10 Fixed in 5.13.10 Patch available CNA

CPE configurations NVD · 12

CPE	Versions	Role	Vendor
cpe:2.3:a:zoom:rooms::::::android::*	before 5.13.5	Vulnerable	Zoom Video Communications, Inc.
cpe:2.3:a:zoom:rooms::::::iphone_os::*	before 5.13.5	Vulnerable	Zoom Video Communications, Inc.
cpe:2.3:a:zoom:rooms::::::linux_kernel::*	before 5.13.5	Vulnerable	Zoom Video Communications, Inc.
cpe:2.3:a:zoom:rooms::::::macos::*	before 5.13.5	Vulnerable	Zoom Video Communications, Inc.
cpe:2.3:a:zoom:rooms::::::windows::*	before 5.13.5	Vulnerable	Zoom Video Communications, Inc.
cpe:2.3:a:zoom:zoom::::::android::*	before 5.13.5	Vulnerable	Zoom Video Communications, Inc.
cpe:2.3:a:zoom:zoom::::::iphone_os::*	before 5.13.5	Vulnerable	Zoom Video Communications, Inc.
cpe:2.3:a:zoom:zoom::::::linux_kernel::*	before 5.13.5	Vulnerable	Zoom Video Communications, Inc.
cpe:2.3:a:zoom:zoom::::::macos::*	before 5.13.5	Vulnerable	Zoom Video Communications, Inc.
cpe:2.3:a:zoom:zoom::::::windows::*	before 5.13.5	Vulnerable	Zoom Video Communications, Inc.

cpe:2.3:a:zoom:rooms:*:*:*:*:*:android:*:* Versions before 5.13.5 Vulnerable ·Zoom Video Communications, Inc.
cpe:2.3:a:zoom:rooms:*:*:*:*:*:iphone_os:*:* Versions before 5.13.5 Vulnerable ·Zoom Video Communications, Inc.
cpe:2.3:a:zoom:rooms:*:*:*:*:*:linux_kernel:*:* Versions before 5.13.5 Vulnerable ·Zoom Video Communications, Inc.
cpe:2.3:a:zoom:rooms:*:*:*:*:*:macos:*:* Versions before 5.13.5 Vulnerable ·Zoom Video Communications, Inc.
cpe:2.3:a:zoom:rooms:*:*:*:*:*:windows:*:* Versions before 5.13.5 Vulnerable ·Zoom Video Communications, Inc.
cpe:2.3:a:zoom:zoom:*:*:*:*:*:android:*:* Versions before 5.13.5 Vulnerable ·Zoom Video Communications, Inc.
cpe:2.3:a:zoom:zoom:*:*:*:*:*:iphone_os:*:* Versions before 5.13.5 Vulnerable ·Zoom Video Communications, Inc.
cpe:2.3:a:zoom:zoom:*:*:*:*:*:linux_kernel:*:* Versions before 5.13.5 Vulnerable ·Zoom Video Communications, Inc.
cpe:2.3:a:zoom:zoom:*:*:*:*:*:macos:*:* Versions before 5.13.5 Vulnerable ·Zoom Video Communications, Inc.
cpe:2.3:a:zoom:zoom:*:*:*:*:*:windows:*:* Versions before 5.13.5 Vulnerable ·Zoom Video Communications, Inc.

Show 2 more CPE

CPE	Versions	Role	Vendor
cpe:2.3:a:zoom:virtual_desktop_infrastructure::::::::	before 5.13.10	Vulnerable	Zoom Video Communications, Inc.
cpe:2.3:o:microsoft:windows:-:::::::*	not specified by NVD	Running on	Microsoft

cpe:2.3:a:zoom:virtual_desktop_infrastructure:*:*:*:*:*:*:*:* Versions before 5.13.10 Vulnerable ·Zoom Video Communications, Inc.
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft

Remediation

Fix · CNA Zoom (for Android, iOS, Linux, macOS, and Windows) (Zoom Video Communications Inc) Fixed in 5.13.5
Fix · CNA Zoom Rooms (for Android, iOS, Linux, macOS, and Windows) (Zoom Video Communications Inc) Fixed in 5.13.5
Fix · CNA Zoom VDI for Windows (Zoom Video Communications Inc) Fixed in 5.13.10

Timeline

2026-10-02 Threatist record created from CVE-2023-28597
2026-10-03 Alias added: GHSA-xwf7-9xfx-ghmm

References

Advisory 1

https://explore.zoom.us/en/trust/security/security-bulletin/

TI-2024-16222 Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for… CVSS 3.1CRITICAL 9.8
TI-2025-31505 Zoom Clients for Windows - Untrusted Search Path CVSS 3.1CRITICAL 9.6
TI-2022-07035 Update package downgrade in Zoom Client for Meetings for Windows CVSS 3.1HIGH 8.8
TI-2024-30470 Zoom Apps - Buffer Overflow CVSS 3.1HIGH 8.8
TI-2022-17145 Local Privilege Escalation in Zoom Rooms for Windows Installers CVSS 3.1HIGH 8.8
TI-2025-20275 Zoom Apps - Heap-based Buffer Overflow CVSS 3.1HIGH 8.8

See all 108 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences