What is CVE-2024-24691?

CVE-2024-24691 is a critical security vulnerability affecting certain versions of Zoom software on Windows systems. This issue, caused by improper input validation, allows an unauthenticated user to potentially escalate their privileges via network access.

Who is impacted by this?

The CVE-2024-24691 vulnerability affects users of Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for Windows. Specifically, those using Zoom Desktop Client for Windows before version 5.16.5, Zoom VDI Client for Windows before version 5.16.10 (excluding 5.14.14 and 5.15.12), Zoom Rooms Client for Windows before version 5.17.0, and Zoom Meeting SDK for Windows before version 5.16.5 are impacted by this issue.

What should I do if I’m afffected?

If you're affected by the CVE-2024-24691 vulnerability, it's crucial to update your Zoom software to protect your system. Follow these simple steps:

1. Visit the Zoom download page.

2. Download the latest version of the affected Zoom product.

3. Install the update on your Windows system.

By keeping your software up-to-date, you can minimize the risk of security threats.

Is this in CISA’s Known Exploited Vulnerabilities Catalog?

The CVE-2024-24691 vulnerability, also known as Improper Input Validation, is not listed in CISA's Known Exploited Vulnerabilities Catalog. It was published on February 13, 2024.

Weakness Enumeration

The weakness enumeration for this vulnerability is categorized as CWE-20, which refers to improper input validation issues in Zoom software on Windows systems.

Learn More

For a comprehensive understanding of this vulnerability, including its description, severity, technical details, and known affected software configurations, refer to the NVD page or the sources listed below.

• Zoom Security Bulletin ZSB-24008