CVE-2021-34415

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-09-27 · updated 2026-06-17
Weakness: CWE-770

Description

The Zone Controller service in the Zoom On-Premise Meeting Connector Controller before version 4.6.358.20210205 does not verify the cnt field sent in incoming network packets, which leads to exhaustion of resources and system crash.

Affected products

Zoom Video Communications Inc Zoom On-Premise Meeting Connector Zone Controller (ZC): before 4.6.358.20210205 — fixed in 4.6.358.20210205

How to fix

Upgrade to a fixed version: Zoom Video Communications Inc Zoom On-Premise Meeting Connector Zone Controller (ZC) 4.6.358.20210205. Check the vendor advisory for mitigations.

References

https://explore.zoom.us/en/trust/security/security-bulletin/
https://explore.zoom.us/en/trust/security/security-bulletin/

Get alerted when CVE-2021-34415 or the next vulnerability affects your stack