CVE-2020-11470

LOW

Zoom Meetings < 4.6.8 - Unauthenticated Microphone and Camera Access via Crafted Library Loading

Title source: llm
STIX 2.1

Description

Zoom Client for Meetings through 4.6.8 on macOS has the disable-library-validation entitlement, which allows a local process (with the user's privileges) to obtain unprompted microphone and camera access by loading a crafted library and thereby inheriting Zoom Client's microphone and camera access.

References (2)

Core 2
Core References
Exploit, Third Party Advisory x_refsource_misc
https://objective-see.com/blog/blog_0x56.html

Scores

CVSS v3 3.3
EPSS 0.0007
EPSS Percentile 21.6%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Details

CWE
CWE-345
Status published
Products (1)
zoom/meetings < 4.6.8
Published Apr 01, 2020
Tracked Since Feb 18, 2026