CVE-2021-34418: Pre-auth Null pointer crash in on-premise web console

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-11-11 · updated 2026-06-17
Weakness: CWE-476

Description

The login routine of the web console in the Zoom On-Premise Meeting Connector before version 4.6.239.20200613, Zoom On-Premise Meeting Connector MMR before version 4.6.239.20200613, Zoom On-Premise Recording Connector before version 3.8.42.20200905, Zoom On-Premise Virtual Room Connector before version 4.4.6344.20200612, and Zoom On-Premise Virtual Room Connector Load Balancer before version 2.5.5492.20200616 fails to validate that a NULL byte was sent while authenticating. This could lead to a crash of the login service.

Affected products

Zoom Video Communications Inc Zoom On-Premise Meeting Connector Controller: before 4.6.239.20200613 — fixed in 4.6.239.20200613
Zoom Video Communications Inc Zoom On-Premise Meeting Connector MMR: before 4.6.239.20200613 — fixed in 4.6.239.20200613
Zoom Video Communications Inc Zoom On-Premise Recording Connector: before 3.8.42.20200905 — fixed in 3.8.42.20200905
Zoom Video Communications Inc Zoom On-Premise Virtual Room Connector: before 4.4.6344.20200612 — fixed in 4.4.6344.20200612
Zoom Video Communications Inc Zoom On-Premise Virtual Room Connector Load Balancer: before 2.5.5492.20200616 — fixed in 2.5.5492.20200616

How to fix

Upgrade to a fixed version: Zoom Video Communications Inc Zoom On-Premise Meeting Connector Controller 4.6.239.20200613; Zoom Video Communications Inc Zoom On-Premise Meeting Connector MMR 4.6.239.20200613; Zoom Video Communications Inc Zoom On-Premise Recording Connector 3.8.42.20200905; Zoom Video Communications Inc Zoom On-Premise Virtual Room Connector 4.4.6344.20200612; Zoom Video Communications Inc Zoom On-Premise Virtual Room Connector Load Balancer 2.5.5492.20200616. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-34418 or the next vulnerability affects your stack