Improper Certificate Validation in Zoom Video Communications, Inc. products - CVE-2025-30669

Vulnerability identifier: #VU118248

CSH Severity: Medium

CVSS v4: 4.8 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-30669

CWE-ID: CWE-295

Exploitation vector: Adjecent network

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform MitM attack.

The vulnerability exists due to improper certificate validation. A remote attacker with ability to intercept traffic can perform a MitM attack and gain access to sensitive information. 

Zoom Workplace Desktop App for Windows
Zoom Workplace Desktop App for Linux
Zoom Meeting SDK for Windows
Zoom Meeting SDK for Linux
Virtual Desktop Infrastructure (VDI)

Install updates from vendor's website.

Zoom Workplace Desktop App for Windows - update to 6.5.10 12704
Zoom Workplace Desktop App for Linux - update to 6.5.10 3973
Zoom Meeting SDK for Windows - update to 6.5.10
Zoom Meeting SDK for Linux - update to 6.5.10
Virtual Desktop Infrastructure (VDI) - addressed in versions 6.3.14.26600, 6.4.12.26620, 6.5.10.26710

• https://www.zoom.com/en/trust/security-bulletin/ZSB-25044/

• MitM attack in Zoom Workplace clients