High severity8.3NVD Advisory· Published Mar 27, 2023· Updated Jun 17, 2026
CVE-2023-28597
CVE-2023-28597
Description
Zoom clients prior to 5.13.5 contain an improper trust boundary implementation vulnerability. If a victim saves a local recording to an SMB location and later opens it using a link from Zoom’s web portal, an attacker positioned on an adjacent network to the victim client could set up a malicious SMB server to respond to client requests, causing the client to execute attacker controlled executables. This could result in an attacker gaining access to a user's device and data, and remote code execution.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
15cpe:2.3:a:zoom:rooms:*:*:*:*:*:android:*:*+ 4 more
- cpe:2.3:a:zoom:rooms:*:*:*:*:*:android:*:*range: <5.13.5
- cpe:2.3:a:zoom:rooms:*:*:*:*:*:iphone_os:*:*range: <5.13.5
- cpe:2.3:a:zoom:rooms:*:*:*:*:*:linux_kernel:*:*range: <5.13.5
- cpe:2.3:a:zoom:rooms:*:*:*:*:*:macos:*:*range: <5.13.5
- cpe:2.3:a:zoom:rooms:*:*:*:*:*:windows:*:*range: <5.13.5
- cpe:2.3:a:zoom:virtual_desktop_infrastructure:*:*:*:*:*:*:*:*Range: <5.13.10
cpe:2.3:a:zoom:zoom:*:*:*:*:*:android:*:*+ 4 more
- cpe:2.3:a:zoom:zoom:*:*:*:*:*:android:*:*range: <5.13.5
- cpe:2.3:a:zoom:zoom:*:*:*:*:*:iphone_os:*:*range: <5.13.5
- cpe:2.3:a:zoom:zoom:*:*:*:*:*:linux_kernel:*:*range: <5.13.5
- cpe:2.3:a:zoom:zoom:*:*:*:*:*:macos:*:*range: <5.13.5
- cpe:2.3:a:zoom:zoom:*:*:*:*:*:windows:*:*range: <5.13.5
- Range: <5.13.5
- Zoom Video Communications, Inc./Zoom (for Android, iOS, Linux, macOS, And Windows) Clients Before Version 5.13.5cpe-rescue2 versions
unspecified+ 1 more
- (no CPE)range: unspecified
- (no CPE)range: unspecified
- Range: unspecified
Patches
Vulnerability mechanics
References
1- explore.zoom.us/en/trust/security/security-bulletin/nvdVendor Advisory
News mentions
0No linked articles in our index yet.