---METADATA---
VENDOR: Zoom
PRODUCT: Workplace
AFFECTED_VERSIONS: Zoom Workplace before version 7.0.4 for Android and before version 7.0.3 for iOS.
---END_METADATA---

Description Summary:
A privilege escalation vulnerability exists in the Zoom Workplace custom URL scheme handler, allowing unauthenticated network-based attackers to elevate their access rights.

Executive Summary:
An improper authorization vulnerability in the Zoom Workplace URL scheme allows unauthenticated network attackers to escalate privileges within the application.

Vulnerability Details

CVE-ID: CVE-2026-53408

Affected Software: Zoom Workplace

Affected Versions: Zoom Workplace before version 7.0.4 for Android and before version 7.0.3 for iOS.

Vulnerability: This is an improper authorization vulnerability in the handler for the custom URL scheme. An unauthenticated attacker with network access can exploit this flaw to escalate privileges within the application.

Business Impact

The CVSS score of 8.1 underscores the critical nature of this privilege escalation flaw. If exploited, an attacker could gain unauthorized administrative or elevated access, resulting in potential data theft, session hijacking, and compromise of communication integrity within the organization.

Remediation Plan

Immediate Action: Update all instances of Zoom Workplace to version 7.0.4 for Android or 7.0.3 for iOS.

Proactive Monitoring: Review enterprise mobile logs for anomalous activity or unexpected URL scheme calls that deviate from standard user behavior.

Compensating Controls: Utilize endpoint security controls to monitor and restrict the execution of custom URL schemes that are not explicitly required for business operations.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 14, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the potential for privilege escalation, it is imperative to enforce the update to the latest versions of Zoom Workplace across all mobile devices. Security teams should prioritize this deployment to prevent unauthorized escalation and ensure platform integrity.

---METADATA---
VENDOR: Zoom
PRODUCT: Workplace
AFFECTED_VERSIONS: Zoom Workplace before version 7.0.4 for Android and before version 7.0.3 for iOS.
---END_METADATA---

Description Summary:
An improper authorization vulnerability in the Zoom Workplace custom URL scheme handler allows unauthenticated users to perform privilege escalation via network access.

Executive Summary:
An improper authorization flaw in the Zoom Workplace URL scheme enables unauthenticated users to escalate privileges, necessitating an immediate application update.

Vulnerability Details

CVE-ID: CVE-2026-53407

Affected Software: Zoom Workplace

Affected Versions: Zoom Workplace before version 7.0.4 for Android and before version 7.0.3 for iOS.

Vulnerability: This is an improper authorization vulnerability within the handler for the custom URL scheme. An unauthenticated user can leverage this flaw via network access to elevate their privileges within the application context.

Business Impact

The CVSS score of 8.1 reflects the high risk associated with privilege escalation. Successful exploitation allows an attacker to bypass established security controls, potentially gaining access to sensitive user data or administrative functions within the Zoom environment, leading to significant reputational and operational damage.

Remediation Plan

Immediate Action: Upgrade Zoom Workplace to version 7.0.4 for Android or 7.0.3 for iOS or later versions.

Proactive Monitoring: Monitor device and application logs for unusual usage patterns or unauthorized attempts to trigger custom URL schemes within the organizational Zoom instance.

Compensating Controls: Implement mobile device management (MDM) policies to restrict unauthorized network access and enforce application version compliance across the enterprise.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 14, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability presents a clear risk to mobile device security and internal Zoom data integrity. Administrators should ensure all mobile endpoints are updated to the specified versions immediately to neutralize the privilege escalation vector.

Executive Summary:
A critical command injection vulnerability has been discovered in Zoom Node Multimedia Routers (MMRs), the core infrastructure responsible for processing meeting traffic. This flaw allows a malicious participant within a meeting to take complete control of the server, potentially leading to service disruption, data theft, and further intrusion into the corporate network. Due to the high severity and potential impact, immediate remediation is strongly advised.

Vulnerability Details

CVE-ID: CVE-2026-22844

Affected Software: Zoom Node Multimedia Routers (MMRs)

Affected Versions: All versions before 5.2.1716.0

Vulnerability: This is a command injection vulnerability that can be triggered by a meeting participant. An attacker can send specially crafted data packets during a meeting session to the MMR. The server fails to properly sanitize this input, interpreting it as a system command and executing it with the privileges of the MMR service. This allows for unauthenticated remote code execution (RCE) on the underlying server by anyone who can join a meeting hosted on a vulnerable MMR.

Business Impact

This vulnerability is rated as critical with a CVSS score of 9.9, representing an extremely high risk to the organization. Successful exploitation could lead to a complete compromise of the affected Zoom Node Multimedia Router. The business impact includes the potential for eavesdropping on sensitive meetings, theft of proprietary data, disruption of critical communication services, and the use of the compromised server as a pivot point to launch further attacks against the internal corporate network.

Remediation Plan

Immediate Action:
Update all affected Zoom Node Multimedia Routers to version 5.2.1716.0 or later as recommended by the vendor. After patching, monitor system logs for any signs of compromise that may have occurred prior to the update. Review access logs for any unusual meeting participant activity.

Proactive Monitoring:

• Log Analysis: Scrutinize MMR service logs for unusual commands, errors, or unexpected process execution. Monitor system-level logs on the server for anomalous activity originating from the MMR service account.
• Network Traffic: Monitor for unexpected outbound connections from MMR servers to unknown IP addresses, which could indicate a reverse shell or data exfiltration.
• System Behavior: Implement host-based monitoring to detect unexpected file creation, modification, or high CPU/memory usage on MMR servers.

Compensating Controls:

• Network Segmentation: Isolate MMRs in a dedicated network segment (DMZ) with strict firewall rules that limit their ability to initiate connections to other critical internal systems.
• Egress Filtering: Implement strict egress firewall rules to block all outbound traffic from MMRs except for what is explicitly required for operation. This can prevent command-and-control (C2) communication.
• Intrusion Detection/Prevention System (IDS/IPS): Deploy network security tools with signatures capable of detecting and blocking common command injection attack patterns.

Exploitation Status

Public Exploit Available: false

Analyst Notes:
As of Jan 20, 2026, there are no known public exploits or active attacks leveraging this vulnerability. However, given the critical severity (CVSS 9.9) and the relative simplicity of the attack vector (requiring only meeting participant access), it is highly probable that threat actors will develop a functional exploit in the near future. Organizations should assume this vulnerability will be exploited.

Analyst Recommendation

Given the critical severity (CVSS 9.9) of this remote code execution vulnerability, immediate action is required. Organizations must prioritize the deployment of the vendor-supplied patch for all affected Zoom Node Multimedia Routers. Although this vulnerability is not yet listed on the CISA Known Exploited Vulnerabilities (KEV) catalog, its high impact and potential for widespread exploitation make it a significant threat. All vulnerable systems should be patched or have compensating controls applied immediately to prevent a potential compromise.

Executive Summary:
A high-severity vulnerability has been discovered in a component used by multiple Zoom products, identified as CVE-2025-47553. This flaw allows an unauthenticated, remote attacker to send specially crafted data to the application, which could result in arbitrary code execution and a complete compromise of the affected system. Due to the critical nature and high CVSS score of 8.8, immediate remediation is strongly recommended to prevent potential data breaches and system takeovers.

Vulnerability Details

CVE-ID: CVE-2025-47553

Affected Software: zoom Multiple Products

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability is classified as Deserialization of Untrusted Data. The affected component, DZS Video Gallery, improperly validates data it receives before deserializing it. An attacker can exploit this by crafting a malicious serialized data object and sending it to the application. When the application processes this data, it deserializes it back into an object in memory, which triggers the "Object Injection" and executes arbitrary code with the permissions of the Zoom application service.

Business Impact

This is a High severity vulnerability with a CVSS score of 8.8. Successful exploitation could have a severe impact on the organization, leading to a full system compromise. The primary risks include the exfiltration of sensitive data processed by the Zoom application, disruption of service, and the ability for an attacker to use the compromised system as a pivot point to move laterally within the corporate network. This could result in significant financial loss, reputational damage, and regulatory penalties depending on the data compromised.

Remediation Plan

Immediate Action:

• Identify all systems running the affected Zoom products.
• Apply the security updates provided by the vendor immediately, prioritizing internet-facing systems.
• After patching, monitor application and system logs for any signs of post-remediation exploitation attempts or indicators of a prior compromise.

Proactive Monitoring:

• Log Analysis: Review application and web server logs for unusual or malformed requests directed at the DZS Video Gallery component. Look for deserialization error messages or unexpected process executions spawned by the Zoom service.
• Network Monitoring: Monitor network traffic for anomalous outbound connections from servers running the affected software, which could indicate a command-and-control (C2) channel.
• Endpoint Detection and Response (EDR): Ensure EDR solutions are monitoring for suspicious process chains or command-line arguments originating from the Zoom application process.

Compensating Controls:

• Web Application Firewall (WAF): If immediate patching is not feasible, implement strict WAF rules to inspect and block known malicious serialized object patterns.
• Network Segmentation: Isolate servers running the vulnerable software from other critical network segments to limit an attacker's ability to move laterally.
• Principle of Least Privilege: Ensure the service account running the Zoom application has the minimum permissions necessary for its operation.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of January 7, 2026, there are no known public proof-of-concept exploits or active exploitation campaigns targeting this vulnerability. However, deserialization vulnerabilities are a well-understood class of bug, and given the high CVSS score, it is highly probable that threat actors and security researchers will develop exploit code in the near future by reverse-engineering the vendor's patch.

Analyst Recommendation

The high severity of this vulnerability warrants immediate and decisive action. Organizations are strongly advised to prioritize the deployment of vendor-supplied patches across all affected assets. Although this vulnerability is not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog, its potential for enabling remote code execution makes it an attractive target for attackers. Proactive patching is the most effective defense and is critical to mitigating the risk of a significant security breach.

Executive Summary:
A critical vulnerability has been identified in the Digital zoom studio (DZS) Video Gallery software, assigned CVE-2025-47552. This flaw, rated with a CVSS score of 9.8, allows an unauthenticated remote attacker to take complete control of an affected server by sending specially crafted data. Successful exploitation could lead to total system compromise, data theft, and significant service disruption.

Vulnerability Details

CVE-ID: CVE-2025-47552

Affected Software: Digital zoom studio DZS Video Gallery

Affected Versions: All versions up to and including 12.37

Vulnerability: The software is vulnerable to Deserialization of Untrusted Data. An attacker can send a malicious, serialized data payload to the application. When the application processes this data, it improperly deserializes it into an object in memory, which triggers the execution of embedded malicious code. This "Object Injection" allows the attacker to achieve Remote Code Execution (RCE) on the server with the permissions of the web application, leading to a full system compromise.

Business Impact

This vulnerability presents a critical risk to the organization, reflected by its CVSS score of 9.8. A successful exploit could allow an attacker to gain complete control over the affected server, leading to severe consequences such as the theft of sensitive business or customer data, deployment of ransomware, disruption of critical services hosted on the server, and using the compromised system as a pivot point to launch further attacks against the internal network. The potential for reputational damage and financial loss is extremely high.

Remediation Plan

Immediate Action: Immediately update the DZS Video Gallery software on all affected systems to the latest version provided by the vendor (a version higher than 12.37). After patching, it is crucial to monitor systems for any signs of exploitation that may have occurred prior to the update and review access logs for suspicious activity.

Proactive Monitoring: Implement enhanced monitoring on affected systems. Look for unusual patterns in web server access logs, such as unexpected or malformed POST requests. Monitor for unexpected processes being spawned by the web server application, unusual outbound network connections, and application error logs that may indicate failed deserialization attempts.

Compensating Controls: If immediate patching is not feasible, implement compensating controls. Place the affected application behind a Web Application Firewall (WAF) with rules specifically designed to inspect and block malicious serialized objects. Restrict network access to the application, allowing connections only from trusted IP addresses. Ensure the application is running with the principle of least privilege to limit the potential impact of a compromise.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Jan 7, 2026, there are no known public exploits or active exploitation campaigns targeting this vulnerability. However, due to the critical severity and the nature of the flaw (RCE), it is highly probable that threat actors will develop and deploy exploits in the near future.

Analyst Recommendation

Given the critical severity (CVSS 9.8) of this vulnerability and its potential for complete system compromise, immediate action is required. We strongly recommend that all instances of DZS Video Gallery version 12.37 and earlier are patched to the latest version without delay. Although this vulnerability is not currently listed on the CISA KEV list, its high score indicates it should be treated with the highest priority. Systems should be considered compromised if any evidence of exploitation is found during log review.

---METADATA---
VENDOR: PTZOptics
PRODUCT: PTZOptics Cameras
AFFECTED_VERSIONS: See enrichment data for specific model ranges
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
PTZOptics and related ValueHD-based cameras utilize default, shared credentials for the administrative web interface, allowing unauthorized access.

Executive Summary:
Critical hard-coded and default credentials in PTZOptics cameras allow unauthenticated attackers to gain full administrative control over the devices.

Vulnerability Details

CVE-ID: CVE-2025-35452

Affected Software: PTZOptics PT12X-SE-xx-G3, PT12X-LINK-4K-xx, PT20X-SE-xx-G3, PT20X-LINK-4K-xx, PT30X-SE-xx-G3, PT30X-LINK-4K-xx

Affected Versions: See "Affected Software" for specific ranges; fixed in 9.1.43, 0.0.63, 9.1.32, 0.0.89, 9.1.33, and 2.0.71 respectively.

Vulnerability: This vulnerability involves the use of hard-coded (CWE-798) and default (CWE-1392) credentials in the administrative web interface. It allows an unauthenticated attacker to bypass authentication and gain full administrative access to the camera hardware.

Business Impact

A successful exploit grants an attacker full control over the camera, which can be used for unauthorized surveillance, data exfiltration, or as a pivot point for further attacks on the internal network. Given the CVSS score of 9.8, this represents a critical risk to physical and digital security.

Remediation Plan

Immediate Action: Update firmware to the identified fixed versions: 9.1.43, 0.0.63, 9.1.32, 0.0.89, 9.1.33, or 2.0.71, depending on the specific model.

Proactive Monitoring: Monitor network traffic for unauthorized login attempts to camera management interfaces and audit device logs for configuration changes.

Compensating Controls: Place all cameras on a dedicated, isolated VLAN with no direct access from the internet and strictly limit administrative access to authorized management workstations.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Sep 8, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently high-risk due to the reliance on static credentials.

Analyst Recommendation

Immediate firmware updates are required to replace default credentials. If updates cannot be applied immediately, the cameras must be removed from public-facing networks and access must be restricted via network segmentation to prevent exploitation by remote attackers.

Executive Summary:
A critical vulnerability has been identified in PTZOptics and other ValueHD-based camera products, stemming from hard-coded administrative credentials. This flaw allows an unauthenticated attacker to easily gain complete control of affected cameras, potentially leading to unauthorized surveillance, network compromise, and operational disruption. Due to the ease of exploitation and the critical impact, immediate remediation is strongly advised.

Vulnerability Details

CVE-ID: CVE-2025-35451

Affected Software: PTZOptics and possibly other Multiple Products

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: Affected pan-tilt-zoom (PTZ) cameras are manufactured with hard-coded, default administrative credentials. An attacker can connect to the camera's exposed SSH or telnet services over the network and authenticate using these known or easily crackable credentials. Successful exploitation grants the attacker root-level or administrative access, allowing them to view and manipulate video feeds, alter device configurations, install malicious software, or use the compromised camera as a pivot point to attack other systems on the internal network.

Business Impact

This vulnerability is rated as critical severity with a CVSS score of 9.8. Exploitation could have a severe impact on the organization, leading to significant security and operational risks. An attacker could compromise physical security by disabling or manipulating camera feeds to hide illicit activities. The breach of confidentiality through unauthorized access to video surveillance can result in espionage, privacy violations, and reputational damage. Furthermore, compromised cameras are frequently co-opted into botnets, which can be used to launch large-scale Distributed Denial-of-Service (DDoS) attacks, consuming network resources and potentially causing widespread service outages.

Remediation Plan

Immediate Action:
The primary remediation step is to update the firmware on all affected PTZOptics and other ValueHD-based cameras to the latest version provided by the vendor. This update is expected to remove the hard-coded credentials and enforce a unique password policy. In parallel, security teams should actively monitor for any signs of exploitation and review historical access logs for unauthorized logins via SSH or telnet.

Proactive Monitoring:

• Log Analysis: Scrutinize system and access logs for successful administrative logins from unknown or suspicious IP addresses, particularly over SSH (port 22) and telnet (port 23).
• Network Traffic: Monitor for anomalous network traffic originating from the cameras, such as connections to known command-and-control (C2) servers or participation in DDoS attacks (e.g., large volumes of UDP or TCP SYN traffic).
• Configuration Integrity: Regularly check for unauthorized configuration changes, new user accounts, or unexpected services running on the devices.

Compensating Controls:
If immediate patching is not feasible, implement the following controls to mitigate risk:

• Network Segmentation: Isolate cameras on a dedicated VLAN with strict firewall rules that only permit access from authorized management stations and video recording systems.
• Access Restriction: Explicitly block all inbound internet access to the cameras' management interfaces (SSH, telnet, web).
• Password Change: If the device firmware allows, immediately change any default passwords to strong, unique credentials.

Exploitation Status

Public Exploit Available: True

Analyst Notes:
As of Sep 5, 2025, there are no specific, widespread exploitation campaigns publicly attributed to this CVE. However, vulnerabilities involving hard-coded credentials are trivial to exploit and are rapidly weaponized by threat actors for automated scanning and botnet recruitment. The technical details required to exploit this vulnerability are public, meaning any attacker can attempt to gain access.

Analyst Recommendation
Given the critical CVSS score of 9.8 and the trivial nature of exploitation, this vulnerability poses an immediate and significant threat to the organization. We strongly recommend that all affected devices be patched immediately. Although this CVE is not currently on the CISA KEV list, its characteristics make it a prime candidate for future inclusion. If patching cannot be performed immediately, the compensating controls outlined above, especially network segmentation and blocking external access, must be implemented without delay to prevent a compromise.

---METADATA---
VENDOR: Zoom
PRODUCT: BitZoom
AFFECTED_VERSIONS: BitZoom 1; See vendor advisory for other versions
---END_METADATA---

Description Summary:
A late-disclosure vulnerability in Zoom BitZoom 1 presents a significant security risk, potentially allowing for unauthorized access or execution within the application environment.

Executive Summary:
Zoom BitZoom 1 is subject to a high-severity vulnerability that could be exploited to compromise application security, necessitating immediate remediation despite its late disclosure.

Vulnerability Details

CVE-ID: CVE-2018-25163

Affected Software: Zoom BitZoom

Affected Versions: BitZoom 1

Vulnerability: This vulnerability, while originating in 2018, has been recently disclosed and affects BitZoom 1. The high CVSS score suggests a critical flaw in input validation or session management that could be exploited by an attacker to gain elevated privileges or execute unauthorized commands.

Business Impact

The impact of this vulnerability includes potential data breaches and unauthorized control over communication tools. With a CVSS score of 8.2, this is a High-severity issue; the late disclosure means that systems may have been vulnerable for years, increasing the risk that historical compromises may have occurred.

Remediation Plan

Immediate Action: Upgrade BitZoom to the most recent version or apply the vendor-provided legacy patch to mitigate the identified risk.

Proactive Monitoring: Conduct a retrospective security audit of logs dating back to the initial deployment of BitZoom 1 to identify any historical signs of unauthorized access.

Compensating Controls: Isolate the BitZoom application within a segmented network and enforce multi-factor authentication (MFA) for all users to limit the potential attack surface.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 8, 2026, there is no public information indicating active exploitation of this vulnerability. The late disclosure (2018 ID) suggests this may have been discovered during a legacy code review or audit.

Analyst Recommendation

Despite the age of the CVE identifier, the CVSS score of 8.2 demands urgent attention. Organizations still utilizing BitZoom 1 must apply updates immediately or transition to a supported version to ensure the security of their communications infrastructure.