CVE-2025-0149
Published: 11 March 2025
Summary
CVE-2025-0149 is a medium-severity Insufficient Verification of Data Authenticity (CWE-345) vulnerability in Zoom Meeting Software Development Kit. Its CVSS base score is 6.5 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 14.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-0149 involves insufficient verification of data authenticity, classified under CWE-345, affecting some Zoom Workplace Apps. Published on 2025-03-11T17:16:17.523, the vulnerability has a CVSS v3.1 base score of 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L), rated as Medium severity.
An unprivileged user with network access can exploit this vulnerability to conduct a denial of service. The attack requires low complexity, no privileges or user interaction, and results in low impacts to integrity and availability with an unchanged scope.
The Zoom security bulletin at https://www.zoom.com/en/trust/security-bulletin/zsb-25008/ provides details on advisories and patches for mitigation.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-7353
Vulnerability details
Insufficient verification of data authenticity in some Zoom Workplace Apps may allow an unprivileged user to conduct a denial of service via network access.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Vulnerability enables remote, unauthenticated exploitation of Zoom apps via insufficient data authenticity verification to cause denial of service, directly mapping to application/system exploitation for endpoint DoS.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-2 requires timely flaw remediation, directly mitigating CVE-2025-0149 by applying patches for the insufficient data authenticity verification as specified in the Zoom security bulletin.
SI-7 enforces integrity verification of information to detect unauthorized modifications or inauthentic data, preventing DoS exploitation due to insufficient authenticity checks.
SC-5 implements denial-of-service protections such as traffic validation and rate limiting, countering the network-based DoS by unprivileged users targeting unverified data authenticity.