Vulnerability in Zoom Meetings
CVE-2022-22786
The Zoom Client for Meetings for Windows before version 5.10.0 and Zoom Rooms for Conference Room for Windows before version 5.10.0, fails to properly check the installation version during the update process. This issue could be used in a more sophisticated attack to trick a user into downgrading their Zoom client to a less secure version.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.015 (73.3th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 73rd percentile — 73.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.015 · newest: 0.015 · change: 0.000
Affected products
- Zoom Meetings
- Zoom Rooms
- Zoom Video Communications Inc Client For Meetings Windows — versions unspecified
- Zoom Video Communications Inc Rooms For Conference Room Windows — versions unspecified
Weakness classification (CWE)
References
- explore.zoom.us/en/trust/security/security-bulletin (Vendor Advisory)
Frequently asked questions
- What is CVE-2022-22786?
- CVE-2022-22786 is a high-severity vulnerability in Zoom Meetings, classified under Download of Code Without Integrity Check. CVSS score: 7.5/10. Published 2022-05-18.
- How severe is CVE-2022-22786?
- High severity. CVSS v3 base score is 7.5 out of 10.