Health check port on ZCC allows tunnel bypass
Priority LOW 23CWE-772Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-772.
Summary
A health check port on Zscaler Client Connector on Windows, versions 4.6 < 4.6.0.216 and 4.7 < 4.7.0.47, which under specific circumstances was not released after use, allowed traffic to potentially bypass ZCC forwarding controls.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00132 2nd percentileScored 2026-11-07
Fix Fixed Zscaler Client Connector (Zscaler): 4.6.0.216, 4.7.0.47
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Zscaler | Zscaler Client Connector | 4.6 to before 4.6.0.216; 4.7 to before 4.7.0.47 | 4.6.0.216, 4.7.0.47 | Patch available | CNA |
- Zscaler Client Connector VendorZscaler Affected 4.6 to before 4.6.0.216; 4.7 to before 4.7.0.47 Fixed in 4.6.0.216, 4.7.0.47 Patch available CNA
Remediation
- Fix · CNA Zscaler Client Connector (Zscaler) Fixed in 4.6.0.216, 4.7.0.47
Timeline
- 2026-10-02 Threatist record created from CVE-2025-54983
- 2026-10-03 Alias added: GHSA-x3hh-fgq4-6rqr
References
More Zscaler vulnerabilities
- TI-2023-22133 Inappropriate file type control in Zscaler Proxy versions 3.6.1.25 and prior allows local… CVSS 3.1MEDIUM 5.5
- TI-2026-42530 Remote code execution in Zscaler Client Connector CVSS 3.1CRITICAL 9.1
- TI-2026-42526 Authentication bypass between ZCC and client connector portal CVSS 3.1CRITICAL 9.1
- TI-2020-09334 The Zscaler Client Connector for Windows prior to 2.1.2.74 had a stack based buffer… CVSS 3.1CRITICAL 9.8
- TI-2024-15528 Local Privilege Escalation via lack of input validation CVSS 3.1CRITICAL 9.8
- TI-2025-34691 SAML 2.0 Public Key Validation Issue CVSS 3.1CRITICAL 9.6
Sources
- CVE-2025-54983 · CVE Program
- CVE-2025-54983 · NVD
- FIRST EPSS
- GHSA-x3hh-fgq4-6rqr · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences