CVE-2023-28597
Zoom Rooms ≤ 5.13.5
Raw vector
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:HSummary
CVE-2023-28597 is a high-severity Trust Boundary Violation (CWE-501) vulnerability in Zoom Rooms. Its CVSS base score is 8.3 (High).
Operationally, ranked at the 42th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-32267
Vulnerability Data
Zoom clients prior to 5.13.5 contain an improper trust boundary implementation vulnerability. If a victim saves a local recording to an SMB location and later opens it using a link from Zoom’s web portal, an attacker positioned on an adjacent…
more
network to the victim client could set up a malicious SMB server to respond to client requests, causing the client to execute attacker controlled executables. This could result in an attacker gaining access to a user's device and data, and remote code execution.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Establishes and maintains trust boundaries with external organizations before allowing their systems to interact with organization resources.
Prevents information from crossing trust boundaries without explicit approved authorizations.
Defining interfaces, controls, and trust responsibilities in agreements helps prevent violations of trust boundaries during data exchanges.
Authorizing and reviewing connections helps maintain proper trust boundaries between internal components.
Controlling media movement outside controlled areas maintains separation between internal and external trust boundaries.
Review of inter-system matching programs identifies and corrects trust-boundary violations before data crosses organizational or policy domains.
Defines explicit trust boundaries for PII use via documented purposes and prevents processing outside those boundaries.
Explicitly binding attributes to information crossing trust boundaries prevents loss of security context that leads to trust-boundary violations.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure-development practices (coding standards, reviews, validation) directly prevent mixing trusted and untrusted data inside the same structures.
Documented data-flow representations make trust boundaries explicit and help surface mixing of trusted/untrusted data.
Logical segmentation and access controls enforce separation between trust domains, reducing the chance of co-mingled data structures.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Secure architecture principles require explicit trust zones and data segregation, mitigating mixing of trusted/untrusted data.
Secure coding standards can enforce input validation and data tagging, but do not guarantee architectural separation.
Secure development lifecycle mandates separation of trusted and untrusted data flows, directly preventing mixing in the same structure.
Application security requirements include explicit trust-boundary definitions and data classification at interfaces.
Network segregation reduces external mixing but does not address internal data-structure trust violations.
Information access restriction limits who sees data but does not prevent mixing trusted and untrusted data within structures.