Zoom Rooms CVE-2025-58133
HIGHAttack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain network access to Zoom Rooms Client
-
ExploitSend request bypassing authentication (CWE-288)
-
ExecutionRetrieve restricted information
-
ImpactConfidentiality impact
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Alternate path authentication
|
| Exploitation Conditions | Requires network access to a vulnerable Zoom Rooms Client (Android, iPadOS, iOS, macOS, or Windows) running a version earlier than 6.5.1. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication, no user interaction, and no special non-default configuration is called out in the description, so default deployments of affected versions appear exploitable by a remote unauthenticated attacker. The principal limiting factors are that the attacker must be able to reach the Zoom Rooms Client over the network and that impact is confined to information disclosure (no integrity or availability effect); upgrading to 6.5.1 or later removes the exposure. |
| Impact | Signals are largely consistent and point to a moderate, not emergency, priority. The vendor-provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated flaw, which aligns with the CWE-288 authentication-bypass classification and the 'unauthenticated user' language in the description. However, impact is limited to confidentiality only (C:H/I:N/A:N) - this is information disclosure, not code execution or takeover, which tempers the 7.5 'High' rating. The EPSS score of 0.28% (19th percentile) is low, the CVE is NOT on the CISA KEV list, and no public POC or exploit code is referenced, so there is no evidence of active or imminent exploitation. In short, the raw CVSS looks alarming because of the unauthenticated network vector, but the confidentiality-only impact plus low EPSS and absent exploitation signals suggest this is a patch-on-normal-cycle issue rather than a drop-everything emergency. The main gap: the Zoom bulletin (zsb-25039) content was not retrieved here, so the exact nature of the disclosed information and the precise affected sub-versions are not independently confirmed. |
| Exploit ScenarioDerived | An attacker with network access to a Zoom Rooms Client running a version below 6.5.1 sends crafted requests that exploit the authentication-bypass flaw, obtaining information that should require authentication without supplying valid credentials. Because the CVSS vector indicates no authentication and low attack complexity, the attacker needs only network reachability to the client. No public exploit code has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
Zoom Rooms Clients prior to version 6.5.1 contain an authentication bypass (CWE-288) that lets a remote, unauthenticated attacker reach an alternate code path and disclose information without supplying valid credentials. The flaw carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), meaning no privileges, no user interaction, and no special configuration are required - only network reachability to an affected client - while confidentiality impact is rated High and integrity/availability are unaffected. Exploitation is not confirmed in the wild: no public exploit code has been identified at time of analysis, and EPSS is a low 0.28% (19th percentile), so this is a moderate, patch-on-schedule issue rather than an emergency. Zoom released version 6.5.1 as the fix.
RemediationAI
Vendor-released patch: upgrade Zoom Rooms Clients to version 6.5.1 or later on every affected platform (Android, iPadOS, iOS, macOS, and Windows); per Zoom security bulletin ZSB-25039 (https://www.zoom.com/en/trust/security-bulletin/zsb-25039), 6.5.1 is the fixed release and deploying it removes the exposure entirely. Because the vulnerability is an unauthenticated, network-reachable authentication bypass with no user interaction, there is no reliable client-side setting that neutralizes it - the fix is the upgrade. As an interim compensating control on Zoom Rooms devices that cannot be patched immediately, restrict network reachability to the client: isolate Zoom Rooms endpoints on a dedicated VLAN/SSID, and use firewall or access-control rules so only the Zoom service endpoints, management hosts, and trusted administrative subnets can initiate connections to the client, blocking general user-network and guest-network access. The trade-off is operational - tight segmentation can break discovery, local controller pairing, and management tooling, so validate connectivity after applying rules, and treat segmentation strictly as a stopgap since it does not address the underlying bypass. Monitor the Zoom trust bulletin for any revision of the fixed version list, and confirm 6.5.1 or later is actually reported by each device after updating rather than assuming auto-update completed.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-288, Authentication Bypass Using an Alternate Path or Channel, which occurs when an application enforces authentication on its expected entry point but exposes a secondary interface, endpoint, or code path that reaches the same privileged functionality without the same checks. In Zoom Rooms Clients this manifests as an unauthenticated remote party being able to traverse that alternate path and read information they should not be able to access. The affected component is the Zoom Rooms client application itself rather than the cloud meeting service, and the corresponding CPE data enumerates the build across five platforms - Android, iPadOS, iPhone OS (iOS), macOS, and Windows - confirming this is a cross-platform client issue rather than a single-OS defect. Because the vector is AV:N/AC:L/PR:N/UI:N, the bypass is reachable over the network with no credentials and no victim action, but the scope is unchanged (S:U) and the sole impact is confidentiality (C:H, I:N, A:N), so an attacker gains access to information rather than the ability to alter or disrupt the client. The 7.5 score reflects that high confidentiality loss combined with an unauthenticated network attack path; the moderate EPSS percentile reflects that broad opportunistic exploitation has not materialized.
Know when Rooms gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Authentication bypass (CWE-288) is remotely reachable and unauthenticated (AV:N/AC:L/PR:N/UI:N); impact is confidentiality-only disclosure, so C:H with I:N/A:N and no scope change.
Primary rating from NVD.
CVSS VectorNVD
DescriptionNVD
Authentication bypass in some Zoom Rooms Clients before version 6.5.1 may allow an unauthenticated user to conduct a disclosure of information via network access.
Executive ViewAI
Zoom Rooms Clients older than version 6.5.1 are affected by a remote, unauthenticated information-disclosure flaw that lets anyone with network reachability to a room system reach an alternate code path and extract data without valid credentials. Because Zoom Rooms devices typically sit on corporate networks and bridge meeting content, configuration, and account data, any exposure of these systems to guest, vendor, or internet-facing networks widens the potential blast radius. Leadership should treat this as a scheduled, medium-priority remediation: no public exploit code has been identified at time of analysis and exploitation is not confirmed, but the upgrade to 6.5.1 should be planned and tracked to closure.
Apply vendor patch: upgrade to Zoom Rooms Client 6.5.1. Where immediate upgrade is not possible, restrict network reachability to affected room systems (segment them from guest, vendor, and internet-facing networks and block inbound access from untrusted sources), and monitor for anomalous data access or configuration retrieval from Zoom Rooms endpoints.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Affected Products (CPE)NVD
Improper input validation in Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for Wind
Untrusted search path in certain Zoom Clients for Windows may allow an unauthenticated user to conduct an escalation of
Improper authorization in some Zoom clients may allow an authorized user to conduct an escalation of privilege via netwo
Improper input validation in the Zoom for Windows, Zoom Rooms, Zoom VDI Windows Meeting clients before 5.14.0 may allow
The Zoom Client for Meetings for Windows before version 5.10.0 and Zoom Rooms for Conference Room for Windows before ver
Buffer overflow in some Zoom Apps may allow an authenticated user to conduct an escalation of privilege via network acce
Buffer overflow in some Zoom Workplace Apps and Rooms Clients may allow an authenticated user to conduct an escalation o
Exposure of sensitive information in Zoom Client SDK's before 5.15.5 may allow an authenticated user to enable a denial
Local privilege escalation in Zoom Rooms for Windows before 6.6.0 allows an attacker with local access and low-level pri
Local privilege escalation in Zoom Rooms for Windows before version 7.1.0 allows an authenticated low-privileged user to
Zoom Client for Windows contains a privilege escalation vulnerability that allows authenticated local users to gain elev
Improper input validation in the installer for some Zoom Apps for Windows may allow an authenticated user to conduct a p
GitHub PoC
Exploit-DB