CVE-2021-34416

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-09-27 · updated 2026-06-17
Weakness: CWE-20

Description

The network address administrative settings web portal for the Zoom on-premise Meeting Connector before version 4.6.360.20210325, Zoom on-premise Meeting Connector MMR before version 4.6.360.20210325, Zoom on-premise Recording Connector before version 3.8.44.20210326, Zoom on-premise Virtual Room Connector before version 4.4.6752.20210326, and Zoom on-premise Virtual Room Connector Load Balancer before version 2.5.5495.20210326 fails to validate input sent in requests to update the network configuration, which could lead to remote command injection on the on-premise image by the web portal administrators.

Affected products

Zoom Video Communications Inc Zoom On-Premise Meeting Connector Zone Controller (ZC): before 4.6.360.20210325 — fixed in 4.6.360.20210325
Zoom Recording Connector: before 3.8.44.20210326 — fixed in 3.8.44.20210326
Zoom Virtual Room Connector: before 4.4.6752.20210326 — fixed in 4.4.6752.20210326
Zoom Virtual Room Connector Load Balancer: before 2.5.5495.20210326 — fixed in 2.5.5495.20210326

How to fix

Upgrade to a fixed version: Zoom Video Communications Inc Zoom On-Premise Meeting Connector Zone Controller (ZC) 4.6.360.20210325; Zoom Recording Connector 3.8.44.20210326; Zoom Virtual Room Connector 4.4.6752.20210326; Zoom Virtual Room Connector Load Balancer 2.5.5495.20210326. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-34416 or the next vulnerability affects your stack