CVE-2026-30901

Executive Summary

CVE-2026-30901 is a privilege escalation vulnerability affecting Zoom Rooms for Windows when running in Kiosk Mode. The flaw stems from improper input validation, allowing an authenticated user with local access to escalate their privileges. The vulnerability has a CVSS score of 7.0 (High) and is patched in version 6.6.5. No public proof-of-concept or exploit code is currently available, and the EPSS score is 0.0%, indicating low exploitation activity in the wild. This vulnerability is specific to the Zoom Rooms application and does not involve any package ecosystem (NPM, PyPI, Go, Ruby).

CVSS Breakdown & Threat Level

• CVSS Score: 7.0 (High)
• Attack Vector: Local (AV:L)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

The threat level is considered High due to the potential for an authenticated user to gain full control over the system, compromising confidentiality, integrity, and availability.

Deep Dive & Mechanics

The vulnerability exists in the Kiosk Mode of Zoom Rooms for Windows. Kiosk Mode is designed to restrict user access to only the Zoom Rooms interface, preventing unauthorized system access. However, due to improper input validation, an authenticated user can bypass these restrictions.

The flaw likely involves the handling of user-supplied input within the Kiosk Mode environment. By crafting a specific input (e.g., a malformed command or path), an attacker can escape the restricted shell or execute arbitrary code with higher privileges. This could be achieved through techniques such as path traversal, command injection, or exploiting a misconfigured application whitelist.

The attack requires local access to the Zoom Rooms device, meaning the attacker must already have a user account on the system or physical access to the device. Once exploited, the attacker can escalate privileges to a higher level (e.g., SYSTEM or Administrator), allowing them to install software, modify system settings, or access sensitive data.

Vulnerable vs. Patched Code

Since no specific code diff is publicly available, the following is a hypothetical example of the vulnerable and patched code patterns.

Vulnerable Code (Zoom Rooms < 6.6.5):

// Example C# code for input validation in Kiosk Mode
public void ExecuteCommand(string userInput)
{
    // Improper validation - allows arbitrary commands
    Process.Start("cmd.exe", "/c " + userInput);
}

Patched Code (Zoom Rooms 6.6.5):

// Example C# code for input validation in Kiosk Mode
public void ExecuteCommand(string userInput)
{
    // Proper validation - only allow specific commands
    string allowedCommands = "start|stop|restart";
    if (Regex.IsMatch(userInput, @"^(" + allowedCommands + ")$"))
    {
        Process.Start("cmd.exe", "/c " + userInput);
    }
    else
    {
        throw new InvalidOperationException("Invalid command.");
    }
}

The patched version implements a whitelist of allowed commands, preventing arbitrary command execution.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Local access to a Zoom Rooms for Windows device running version < 6.6.5.
• An authenticated user account on the system.

Exploitation Steps:

1. Gain local access to the Zoom Rooms device (e.g., via SSH, RDP, or physical access).
2. Identify the Kiosk Mode application process (e.g., ZoomRooms.exe).
3. Craft a malicious input to exploit the improper input validation. For example, if the application allows launching a browser, use a command like:

   file:///C:/Windows/System32/cmd.exe
   

   or

   javascript:alert('test')
   

4. Execute the crafted input to escape the Kiosk Mode and launch a command prompt or other privileged application.
5. Escalate privileges using known techniques (e.g., token manipulation, service exploitation).

Example Payload (Hypothetical):

# PowerShell script to exploit CVE-2026-30901
$payload = "file:///C:/Windows/System32/WindowsPowerShell/v1.0/powershell.exe -Command Start-Process cmd -Verb RunAs"
Invoke-Expression $payload

Blue Team (Detection & Mitigation)

Detection Steps:

1. Monitor for unusual process creation events from the Zoom Rooms application (e.g., ZoomRooms.exe spawning cmd.exe, powershell.exe, or other shells).
2. Enable logging for Windows Event ID 4688 (Process Creation) and filter for parent process ZoomRooms.exe.
3. Monitor for file access attempts to sensitive system directories (e.g., C:\Windows\System32) from the Zoom Rooms process.
4. Use application whitelisting (e.g., AppLocker) to restrict which executables can be launched from the Zoom Rooms directory.

Mitigation Steps:

1. Apply the official patch by upgrading to Zoom Rooms for Windows version 6.6.5 or later.
2. If patching is not immediately possible, disable Kiosk Mode or restrict local access to the device.
3. Implement the principle of least privilege for user accounts on Zoom Rooms devices.

Indicators of Compromise (IOCs)

• Process Creation: ZoomRooms.exe spawning cmd.exe, powershell.exe, wscript.exe, or cscript.exe.
• File Access: Unusual access to C:\Windows\System32\cmd.exe or C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe by ZoomRooms.exe.
• Registry Changes: Modifications to registry keys under HKLM\SOFTWARE\Zoom or HKCU\Software\Zoom that enable privilege escalation.
• Network Connections: Outbound connections from ZoomRooms.exe to unexpected IP addresses or domains (e.g., for command and control).

Detection Engineering

YARA Rule

rule CVE_2026_30901_Zoom_Rooms_EoP {
    meta:
        description = "Detects potential exploitation of CVE-2026-30901 in Zoom Rooms for Windows"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-30901"
    strings:
        $s1 = "ZoomRooms.exe" ascii wide nocase
        $s2 = "cmd.exe" ascii wide nocase
        $s3 = "powershell.exe" ascii wide nocase
        $s4 = "file:///" ascii wide nocase
    condition:
        $s1 and ($s2 or $s3 or $s4)
}

Sigma Rule

title: CVE-2026-30901 - Zoom Rooms Privilege Escalation
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects process creation events where ZoomRooms.exe spawns a shell
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-30901
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith: '\ZoomRooms.exe'
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\wscript.exe'
            - '\cscript.exe'
    condition: selection
falsepositives:
    - Legitimate administrative tasks
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-30901 - Zoom Rooms Potential EoP Outbound"; flow:to_server,established; content:"ZoomRooms"; nocase; content:"cmd.exe"; nocase; distance:0; within:100; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Upgrade all Zoom Rooms for Windows installations to version 6.6.5 or later. This is the only official fix.
2. Workaround: If patching is delayed, disable Kiosk Mode on Zoom Rooms devices or restrict local user accounts to prevent exploitation.
3. Monitoring: Implement the detection rules provided above to identify any exploitation attempts.
4. Access Control: Ensure that only authorized personnel have local access to Zoom Rooms devices. Use strong authentication and audit logging.
5. Vendor Advisory: Monitor Zoom's official security advisory page for updates: https://zoom.us/trust/security/security-bulletin

Valters IT
DevSecOps & Cyber Threat Intelligence