CVE-2021-34417: Authenticated remote command execution with root privileges via web console in MMR

Severity: high (CVSS 7.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-11-11 · updated 2026-06-17
Weakness: CWE-20

Description

The network proxy page on the web portal for the Zoom On-Premise Meeting Connector Controller before version 4.6.365.20210703, Zoom On-Premise Meeting Connector MMR before version 4.6.365.20210703, Zoom On-Premise Recording Connector before version 3.8.45.20210703, Zoom On-Premise Virtual Room Connector before version 4.4.6868.20210703, and Zoom On-Premise Virtual Room Connector Load Balancer before version 2.5.5496.20210703 fails to validate input sent in requests to set the network proxy password. This could lead to remote command injection by a web portal administrator.

Affected products

Zoom Video Communications Inc Zoom On-Premise Meeting Connector Controller: before 4.6.365.20210703 — fixed in 4.6.365.20210703
Zoom Video Communications Inc Zoom On-Premise Meeting Connector MMR: before 4.6.365.20210703 — fixed in 4.6.365.20210703
Zoom Video Communications Inc Zoom On-Premise Recording Connector: before 3.8.45.20210703 — fixed in 3.8.45.20210703
Zoom Video Communications Inc Zoom On-Premise Virtual Room Connector: before 4.4.6868.20210703 — fixed in 4.4.6868.20210703
Zoom Video Communications Inc Zoom On-Premise Virtual Room Connector Load Balancer: before 2.5.5496.20210703 — fixed in 2.5.5496.20210703

How to fix

Upgrade to a fixed version: Zoom Video Communications Inc Zoom On-Premise Meeting Connector Controller 4.6.365.20210703; Zoom Video Communications Inc Zoom On-Premise Meeting Connector MMR 4.6.365.20210703; Zoom Video Communications Inc Zoom On-Premise Recording Connector 3.8.45.20210703; Zoom Video Communications Inc Zoom On-Premise Virtual Room Connector 4.4.6868.20210703; Zoom Video Communications Inc Zoom On-Premise Virtual Room Connector Load Balancer 2.5.5496.20210703. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-34417 or the next vulnerability affects your stack