What is CVE-2024-23457?

CVE-2024-23457 is a high-severity vulnerability in Zscaler Client Connector, classified under Improper Privilege Management. CVSS score: 7.8/10. Published 2024-05-01.

How severe is CVE-2024-23457?

High severity. CVSS v3 base score is 7.8 out of 10.

Is CVE-2024-23457 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Privilege escalation in Zscaler Client Connector

CVE-2024-23457

The anti-tampering functionality of the Zscaler Client Connector can be disabled under certain conditions when an uninstall password is enforced. This affects Zscaler Client Connector on Windows prior to 4.2.0.209

Vulnerability class: Privilege Escalation

EPSS: 0.002 (10.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected products

Zscaler Client Connector — versions 0
Zscaler Client_connector

Weakness classification (CWE)

CWE-269 — Improper Privilege Management

Public proof-of-concept exploits

fkie-cad/nvd-json-data-feeds

References

cve@zscaler.com (Release Notes, Vendor Advisory)

Frequently asked questions

What is CVE-2024-23457?: CVE-2024-23457 is a high-severity vulnerability in Zscaler Client Connector, classified under Improper Privilege Management. CVSS score: 7.8/10. Published 2024-05-01.
How severe is CVE-2024-23457?: High severity. CVSS v3 base score is 7.8 out of 10.
Is CVE-2024-23457 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.