CVE-2025-62483

Executive Summary

CVE-2025-62483 is a moderate-severity information disclosure vulnerability affecting Zoom Clients prior to version 6.5.10. The flaw stems from improper removal of sensitive information, allowing an unauthenticated attacker to potentially access sensitive data via network access. With a CVSS score of 5.3, the vulnerability is exploitable remotely without authentication, but the impact is limited to confidentiality. No public proof-of-concept (PoC) or exploit code is currently available, and the EPSS score is 0.0%, indicating low exploitation likelihood at this time. The vendor, Zoom, has released a patched version (6.5.10) to address the issue.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Base Score: 5.3 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L)
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

Threat Level: Medium. The vulnerability allows unauthenticated remote attackers to disclose sensitive information, but the impact is limited to low confidentiality. No active exploitation has been observed, and the EPSS score is negligible.

Deep Dive & Mechanics

The vulnerability resides in the improper sanitization of sensitive data within Zoom Client’s network communication. When the client processes certain network requests, it fails to properly remove sensitive information (e.g., session tokens, internal IP addresses, or configuration details) from responses or error messages. An unauthenticated attacker on the same network can craft a malicious request to trigger the disclosure of this data.

Root Cause: The Zoom Client does not strip sensitive fields from network responses before sending them to the client-side. This is a classic CWE-212 (Improper Removal of Sensitive Information Before Storage or Transfer) issue.

Attack Vector: The attacker must be on the same network segment as the target Zoom Client (e.g., same Wi-Fi or local network). The attack does not require user interaction or authentication.

Impact: An attacker could obtain information such as:

• Internal IP addresses
• Session identifiers (if not properly protected)
• Configuration details that could aid further attacks

Vulnerable vs. Patched Code

Vulnerable Code (pre-6.5.10):

// Example of vulnerable response handling
function handleResponse(response) {
    // Sensitive data is not removed
    return response;
}

Patched Code (6.5.10+):

// Example of patched response handling
function handleResponse(response) {
    // Remove sensitive fields before returning
    const sanitized = sanitizeResponse(response);
    return sanitized;
}

The patch introduces a sanitization function that strips sensitive information from network responses before they are processed by the client.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Target running Zoom Client < 6.5.10
• Attacker on same network segment (e.g., Wi-Fi)
• No authentication required

Exploitation Steps:

1. Identify a target Zoom Client on the local network.
2. Craft a malicious network request to the Zoom Client’s listening service (e.g., on port 8801 or similar).
3. Send the request and capture the response.
4. Extract sensitive information from the response.

Example Request (using netcat):

echo -e "GET /zoom/sensitive HTTP/1.1\r\nHost: target:8801\r\n\r\n" | nc target 8801

Expected Output:

HTTP/1.1 200 OK
Content-Type: application/json
...
{"session_token":"abc123","internal_ip":"192.168.1.100"}

Blue Team

Detection:

• Monitor for unusual network requests to Zoom Client ports (e.g., 8801, 8802).
• Look for responses containing sensitive data patterns (e.g., session tokens, internal IPs).

Hunting Queries:

• Search for Zoom Client logs containing "sensitive" or "token" in network responses.
• Use network monitoring tools to capture and inspect Zoom Client traffic.

Indicators of Compromise (IOCs)

• Network Traffic: Unusual HTTP requests to Zoom Client ports (8801, 8802) with suspicious paths like /zoom/sensitive or /config.
• Log Entries: Zoom Client logs containing unexpected sensitive data in responses.
• File Artifacts: Temporary files created by Zoom Client that contain sensitive information (e.g., zoom_sensitive_data.tmp).

Detection Engineering

YARA Rule

rule CVE_2025_62483_Zoom_InfoDisclosure {
    meta:
        description = "Detects Zoom Client responses containing sensitive information"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-62483"
    strings:
        $sensitive1 = "session_token" ascii wide nocase
        $sensitive2 = "internal_ip" ascii wide nocase
        $sensitive3 = "zoom_config" ascii wide nocase
    condition:
        any of ($sensitive*)
}

Sigma Rule

title: Zoom Client Sensitive Information Disclosure
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects network responses from Zoom Client containing sensitive data
author: Valters IT
date: 2025/04/10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-62483
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        DestinationPort:
            - 8801
            - 8802
        ResponseBody|contains:
            - 'session_token'
            - 'internal_ip'
            - 'zoom_config'
    condition: selection
falsepositives:
    - Legitimate Zoom Client responses (if patched)
level: medium

Suricata Rule

alert tcp any any -> any 8801,8802 (msg:"CVE-2025-62483 Zoom Client Information Disclosure"; flow:to_client; content:"session_token"; nocase; content:"internal_ip"; nocase; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade all Zoom Clients to version 6.5.10 or later.
2. Restrict network access to Zoom Client ports (8801, 8802) using firewall rules.
3. Monitor network traffic for anomalous Zoom Client responses.

Long-term Measures:

• Implement network segmentation to limit exposure of Zoom Clients.
• Regularly update Zoom software to the latest version.
• Conduct security reviews of Zoom Client configurations.

Workarounds:

• If immediate patching is not possible, disable unnecessary Zoom Client network services or use a VPN to isolate traffic.

Valters IT