Improper Certificate Validation in Zoom Video Communications, Inc. products - CVE-2025-30669
Published: November 11, 2025
Vulnerability identifier: #VU118248
CSH Severity: Medium
CVSS v4.0: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2025-30669
CWE-ID: CWE-295
Exploitation vector: Adjecent network
Exploit availability:
No public exploit available
Vendor: Zoom Video Communications, Inc.
Affected software:
Zoom Workplace Desktop App for Windows
Zoom Workplace Desktop App for Linux
Virtual Desktop Infrastructure (VDI)
Zoom Meeting SDK for Windows
Zoom Meeting SDK for Linux
Zoom Workplace Desktop App for Windows
Zoom Workplace Desktop App for Linux
Virtual Desktop Infrastructure (VDI)
Zoom Meeting SDK for Windows
Zoom Meeting SDK for Linux
Detailed vulnerability description
The vulnerability allows a remote attacker to perform MitM attack.
The vulnerability exists due to improper certificate validation. A remote attacker with ability to intercept traffic can perform a MitM attack and gain access to sensitive information.
How to mitigate CVE-2025-30669
Install updates from vendor's website.