Critical Zoom for Windows vulnerability allows hackers to hijack accounts without a password

Zoom has issued an urgent update alert warning that hackers can take over accounts simply via network access without a password or any user interaction – Windows users must update now. The critical vulnerability affects desktop and virtualized clients, as well as the SDK for embedding the functionality in other apps.

Zoom vulnerability is as bad as it gets, rated 9.8 out of 10 on the severity score. The app doesn't properly validate user input, which attackers can exploit to hijack accounts.

The bug “may allow an unauthenticated user to conduct an account takeover via network access,” the company said.

Zoom issued urgent updates for the Zoom Desktop Client for Windows and Zoom VDI (Zoom Virtual Desktop Infrastructure) for Windows, and said it removed Meeting SDK for Windows as an affected product.

“Users can help keep themselves secure by applying the latest updates,” the company explains.

The attack complexity is low, meaning hackers wouldn’t need any special conditions to carry it out. No privileges or user interaction are needed, meaning the attack can happen without any user involvement.

Potential attacks can be devastating, as attackers with stolen accounts can access private sensitive data in full, including meetings, chat, recordings, account information, or attempt to impersonate the user.

The security advisory doesn’t provide any details the vulnerability or whether it’s been exploited in the wild. It was reported by the company’s own Zoom Offensive Security team. However, given the critical severity score, the exploitation is likely imminent.

Normally, attackers can’t simply access the software running on local machines over the network, because users are protected by their firewalls (routers) from any inbound connections. However, the Zoom app constantly initiates outbound connections to its servers and to meeting participants, and attackers might insert themselves along the path.

The flaw lies in how the app processes the data it receives, allowing specially crafted network packets to trigger abnormal behavior.

The bug doesn’t affect Mac, Linux, iOS, or Android clients.

The updates also fix 3 other Zoom for Windows high-severity vulnerabilities : a race condition in the desktop client, an improper privilege management flaw in Zoom Rooms, and another improper input validation flaw in the Workplace VDI plugin for Windows.