CVE-2025-64741

Executive Summary

CVE-2025-64741 is a critical improper authorization vulnerability in Zoom Workplace for Android prior to version 6.5.10. An unauthenticated attacker can exploit this flaw over the network to escalate privileges, potentially gaining unauthorized access to sensitive data or system functions. The vulnerability has a CVSS score of 8.1 (High) and currently has no known public proof-of-concept or exploit code. The vendor has released a fix in version 6.5.10, but no OSV or GitHub advisory data is available.

Supply Chain & Package Security

This vulnerability affects the Zoom Workplace Android application, which is distributed through official app stores (Google Play Store). Users should ensure they update to version 6.5.10 or later from trusted sources. No third-party package manager (NPM, PyPI, Go, Ruby) is involved.

CVSS Breakdown & Threat Level

• CVSS Score: 8.1 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

The high CVSS score reflects the ease of exploitation (no authentication or user interaction required) and the severe impact on confidentiality, integrity, and availability.

Deep Dive & Mechanics

The vulnerability stems from improper authorization handling in the Zoom Workplace Android application. The application fails to properly validate user permissions when processing network requests, allowing an unauthenticated attacker to bypass authorization checks and escalate privileges. This could enable an attacker to:

• Access sensitive user data (contacts, messages, meeting recordings)
• Modify application settings
• Execute privileged actions on behalf of the user
• Potentially pivot to other systems within the network

The exact attack vector is network-based, meaning the attacker must be on the same network as the victim device or be able to intercept/manipulate network traffic (e.g., via a malicious Wi-Fi hotspot or man-in-the-middle attack).

Vulnerable vs. Patched Code

Since no specific code snippets are available from public sources, the following is a hypothetical example of the vulnerable and patched code patterns.

Vulnerable Code (before 6.5.10):

// Vulnerable: No authorization check
public void handleNetworkRequest(Request request) {
    // Directly process request without verifying user permissions
    processRequest(request);
}

Patched Code (6.5.10 and later):

// Patched: Proper authorization check
public void handleNetworkRequest(Request request) {
    if (!isAuthorized(request.getUser())) {
        throw new SecurityException("Unauthorized access");
    }
    processRequest(request);
}

The patch adds a permission verification step before processing any network request, ensuring only authenticated and authorized users can perform privileged actions.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Android device running Zoom Workplace < 6.5.10
• Network access to the victim device (same subnet or MITM position)
• Tools: Burp Suite, mitmproxy, or custom Python script

Exploitation Steps:

1. Set up a man-in-the-middle proxy (e.g., mitmproxy) to intercept traffic between the Zoom app and its servers.
2. Identify network requests that perform privileged actions (e.g., user profile modification, meeting control).
3. Craft a malicious request that mimics a legitimate user but without proper authentication tokens.
4. Send the crafted request to the Zoom app's network endpoint.
5. If successful, the app will process the request and escalate privileges.

Example Python script (conceptual):

import requests

target_url = "https://zoom.us/api/privileged_action"
malicious_payload = {
    "action": "escalate_privileges",
    "user_id": "victim_user"
}
# No authentication headers
response = requests.post(target_url, json=malicious_payload)
print(response.text)

Blue Team

Detection Steps:

1. Monitor network traffic for unusual requests to Zoom endpoints without proper authentication headers.
2. Check Zoom Workplace app version on all Android devices; ensure version is 6.5.10 or later.
3. Review application logs for authorization failures or unexpected privilege escalation attempts.
4. Implement network segmentation to limit exposure of vulnerable devices.

Hunting Queries:

• Search for Zoom app versions < 6.5.10 in MDM solutions.
• Look for network connections from Zoom app to unusual IP addresses or domains.

Indicators of Compromise (IOCs)

• Network: Unauthorized requests to Zoom API endpoints without valid authentication tokens.
• Application: Zoom Workplace for Android version < 6.5.10.
• Logs: Repeated authorization failure events in Zoom app logs.
• File: No specific file-based IOCs identified.

Detection Engineering

YARA Rule

rule CVE_2025_64741_Zoom_Android {
    meta:
        description = "Detects Zoom Workplace Android versions vulnerable to CVE-2025-64741"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-64741"
    strings:
        $version_low = "6.5.9" nocase
        $version_older = "6.5." nocase
    condition:
        $version_low or ($version_older and not for any of them : ($version_older contains "6.5.10"))
}

Sigma Rule

title: CVE-2025-64741 - Unauthorized Privilege Escalation in Zoom Workplace Android
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects network requests to Zoom endpoints without proper authentication, indicating possible exploitation of CVE-2025-64741.
author: Valters IT
date: 2025/04/10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-64741
logsource:
    category: network_connection
    product: zeek
detection:
    selection:
        destination_port: 443
        destination_domain: "zoom.us"
        http_request_method: "POST"
        http_request_uri: "/api/*"
        http_request_headers: "Authorization:"
    condition: not selection
falsepositives:
    - Legitimate requests from older versions
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET 443 (msg:"CVE-2025-64741 - Unauthorized Zoom API Request"; flow:to_server; content:"POST"; http_method; content:"/api/"; http_uri; content:!"Authorization"; http_header; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update Zoom Workplace for Android to version 6.5.10 or later from the Google Play Store.
2. If update is not possible, restrict network access for the Zoom app using firewall rules or MDM policies.
3. Monitor for any suspicious activity related to Zoom app usage.

Long-term Measures:

• Implement application whitelisting to only allow approved versions.
• Conduct regular vulnerability scans of mobile devices.
• Educate users about the risks of connecting to untrusted networks.

Workarounds:

• Disable Zoom Workplace app until patched.
• Use VPN to encrypt traffic and reduce MITM risk.

Valters IT