CVE-2019-13450

Vulnerability

The Zoom Client for macOS through version 4.4.4 and RingCentral 7.0.136380.0312 installs a local web server that listens on ports 19421 or 19424 on localhost. Any arbitrary web page visited in a browser can communicate with this server, enabling it to issue commands such as initiating a video call with the camera activated. This occurs because the web server does not enforce origin restrictions or require any authentication. The vulnerability persists even after uninstallation if the ~/.zoomus directory remains.

Exploitation

An attacker needs only to host a malicious web page and entice a victim to visit it using a browser (such as Safari, Chrome, or Firefox) on the same machine where Zoom is installed. No authentication, prior interaction with the Zoom app, or special network access is required. The web page sends HTTP requests to http://localhost:19421 or http://localhost:19424 to invoke the Zoom URI handler or directly command the local server, forcing the client to join a video conference with the camera enabled [1][2].

Impact

Successful exploitation allows a remote attacker to turn on the victim's webcam and join a video call without the user's knowledge or consent. This is a severe privacy and surveillance risk, resulting in unauthorized video and potentially audio capture. The attacker gains no access to files or system code execution, but achieves a serious violation of the user's physical privacy. Since the camera activation occurs silently, the victim may remain unaware until after the fact.

Mitigation

Zoom declined to patch the vulnerability, stating it was not a security issue [1]. Users must manually disable the local web server. Mitigation steps include: setting the ZDisableVideo preference via defaults write zoom.us ZDisableVideo 1, killing the web server process, deleting the ~/.zoomus directory, and creating an empty ~/.zoomus plain file to prevent its recreation [1][2]. The vendor has not released a fixed version; the vulnerability remains open on all installations where these manual hardening steps are not applied.