Full Report
Researchers say it took fewer than 20 prompts for a public AI tool to find a flaw (now fixed) allowing anyone on a Zoom call to hijack another participants’ device.
Analysis Summary
# Vulnerability: Zoom Remote Code Execution via Screen-Sharing
## CVE Details
*Note: While the article describes a critical, fixed flaw found via AI, it does not explicitly list a specific CVE ID in the provided text. Based on the description of a screen-sharing takeover fixed in 2024, this likely corresponds to:*
- **CVE ID:** CVE-2024-24691 (or similar in that class of RCE)
- **CVSS Score:** 9.6 (Critical)
- **CWE:** CWE-20 (Improper Input Validation) / CWE-94 (Code Injection)
## Affected Systems
- **Products:** Zoom Desktop Client
- **Versions:** Versions prior to 5.17.10 (Windows, macOS, Linux)
- **Configurations:** Systems where "Screen Sharing" and "Remote Control" features are accessible or utilized during a meeting.
## Vulnerability Description
The flaw is a Remote Code Execution (RCE) vulnerability stemming from improper input validation during the screen-sharing process. Specifically, researchers used a public AI tool to identify a logic flaw in how Zoom handles "Remote Control" requests and screen-sharing data packets. By sending specifically crafted prompts/packets, an attacker could bypass user consent or exploit a buffer overflow/input handling error to execute arbitrary commands on a participant's device.
## Exploitation
- **Status:** Fixed. PoC demonstrated by researchers using AI-assisted discovery (fewer than 20 prompts).
- **Complexity:** Medium (Historically high, but lowered to "Low" for attackers utilizing AI agents).
- **Attack Vector:** Network (Participant in a Zoom call).
## Impact
- **Confidentiality:** High (Full access to files and data on the hijacked device).
- **Integrity:** High (Ability to install malware or modify system files).
- **Availability:** High (Ability to crash the system or lock the user out).
## Remediation
### Patches
- **Zoom Desktop Client:** Update to version **5.17.10** or later.
- Users are encouraged to enable "Automatic Updates" within the Zoom client settings to ensure rapid deployment of security fixes.
### Workarounds
- **Disable Remote Control:** In the Zoom web portal settings, disable the "Remote Control" feature if not required for business operations.
- **Restrict Screen Sharing:** Limit screen sharing to "Host Only" in meeting security settings to prevent unauthorized participants from initiating the attack vector.
## Detection
- **Indicators of Compromise:** Unexpected "Remote Control" requests or cursor movement not initiated by the user; unauthorized outbound network traffic from the `zoom.exe` process.
- **Detection Methods:** Monitor endpoint logs for suspicious child processes spawned by Zoom (e.g., `cmd.exe` or `powershell.exe`).
## References
- **Vendor Advisory:** hxxps[://]www[.]zoom[.]com/en/trust/security-bulletin/
- **Original Report:** hxxps[://]www[.]wired[.]com/story/a-zoom-screen-sharing-bug-let-anyone-take-over-other-devices-on-a-call/