CVE-2022-36925 MEDIUM

CVE-2022-36925: Insecure key generation for Zoom Rooms for macOS Clients

Vendor Zoom Video Communications Inc
Product Zoom Rooms for macOS
Weakness CWE-321
Published January 9, 2023
Last update April 9, 2025

CVSS base score

4.4/10
Attack vector Local
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality None
Integrity Low

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

What the vulnerability does

01Description

Zoom Rooms for macOS clients before version 5.11.4 contain an insecure key generation mechanism. The encryption key used for IPC between the Zoom Rooms daemon service and the Zoom Rooms client was generated using parameters that could be obtained by a local low-privileged application. That key can then be used to interact with the daemon service to execute privileged functions and cause a local denial of service.

Key dates

02Disclosure timeline

January 9, 2023 CVE published
April 9, 2025 Record updated