CVE-2023-41970: Repair App local code execution with arbitrary privileges

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-05-02 · updated 2026-06-17
Weakness: CWE-354

Description

An Improper Validation of Integrity Check Value vulnerability in Zscaler Client Connector on Windows during the Repair App functionality may allow Local Execution of Code.This issue affects Client Connector on Windows: before 4.1.0.62.

Affected products

Zscaler Client Connector: before 4.1.0.62 — fixed in 4.1.0.62

How to fix

Upgrade to a fixed version: Zscaler Client Connector 4.1.0.62. Check the vendor advisory for mitigations.

References

https://help.zscaler.com/client-connector/client-connector-app-release-summary-2022?applicable_category=windows&applicable_version=4.1
https://help.zscaler.com/client-connector/client-connector-app-release-summary-2022?applicable_category=windows&applicable_version=4.1

Get alerted when CVE-2023-41970 or the next vulnerability affects your stack