CVE-2021-34414

Severity: high (CVSS 7.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-09-27 · updated 2026-06-17
Weakness: CWE-20

Description

The network proxy page on the web portal for the Zoom on-premise Meeting Connector Controller before version 4.6.348.20201217, Zoom on-premise Meeting Connector MMR before version 4.6.348.20201217, Zoom on-premise Recording Connector before version 3.8.42.20200905, Zoom on-premise Virtual Room Connector before version 4.4.6620.20201110, and Zoom on-premise Virtual Room Connector Load Balancer before version 2.5.5495.20210326 fails to validate input sent in requests to update the network proxy configuration, which could lead to remote command injection on the on-premise image by a web portal administrator.

Affected products

Zoom Video Communications Inc Zoom On-Premise Meeting Connector Zone Controller (ZC): before 4.6.348.20201217 — fixed in 4.6.348.20201217
Zoom Recording Connector: before 3.8.42.20200905 — fixed in 3.8.42.20200905
Zoom Virtual Room Connector: before 4.4.6620.20201110 — fixed in 4.4.6620.20201110
Zoom Virtual Room Connector Load Balancer: before 2.5.5495.20210326 — fixed in 2.5.5495.20210326

How to fix

Upgrade to a fixed version: Zoom Video Communications Inc Zoom On-Premise Meeting Connector Zone Controller (ZC) 4.6.348.20201217; Zoom Recording Connector 3.8.42.20200905; Zoom Virtual Room Connector 4.4.6620.20201110; Zoom Virtual Room Connector Load Balancer 2.5.5495.20210326. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-34414 or the next vulnerability affects your stack