CVE-2025-0145
Published: 30 January 2025
Summary
CVE-2025-0145 is a medium-severity Untrusted Search Path (CWE-426) vulnerability in Zoom Workplace Virtual Desktop Infrastructure. Its CVSS base score is 4.6 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Path Interception by Search Order Hijacking (T1574.008); ranked at the 25.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and CM-11 (User-installed Software).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the untrusted search path vulnerability in the Zoom Workplace installer by applying vendor patches as specified in Zoom's security bulletin.
Establishes and enforces organizational policies governing user-installed software, restricting execution of the vulnerable Zoom installer that requires user interaction for exploitation.
Verifies the integrity of software and firmware components loaded during installer execution, mitigating untrusted search path exploitation by detecting tampered or unauthorized binaries.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Untrusted search path in Windows installer directly enables search order hijacking for local privilege escalation.
NVD Description
Untrusted search path in the installer for some Zoom Workplace Apps for Windows may allow an authorized user to conduct an escalation of privilege via local access.
Deeper analysisAI
CVE-2025-0145 is an untrusted search path vulnerability (CWE-426) affecting the installer for some Zoom Workplace Apps for Windows. Published on 2025-01-30, it carries a CVSS v3.1 base score of 4.6 (AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:L). The issue enables an authorized user with local access to potentially escalate privileges by exploiting the untrusted search path during installer execution.
Exploitation requires local access, low privileges, low attack complexity, and user interaction. A malicious actor meeting these conditions could leverage the vulnerability to achieve privilege escalation, resulting in low impacts to integrity and availability within a changed scope, but no confidentiality impact.
Zoom's security bulletin ZSB-25004 at https://www.zoom.com/en/trust/security-bulletin/zsb-25004/ provides further details on mitigation and patches.
Details
- CWE(s)