CVE-2025-46788

High

Published: 10 July 2025

Published

10 July 2025

Modified

05 August 2025

KEV Added

—

Patch

—

CVSS Score 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

EPSS Score 0.0011 28.3th percentile

Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-46788 is a high-severity Improper Certificate Validation (CWE-295) vulnerability in Zoom Workplace Desktop. Its CVSS base score is 7.4 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Adversary-in-the-Middle (T1557); ranked at the 28.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

Threat & Defense at a Glance

What attackers do: exploitation maps to Adversary-in-the-Middle (T1557).

Threat & Defense Details

Likely Mitigating ControlsAI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

SA-19 Component Authenticity

addresses: CWE-295

When certificates are used to establish component provenance, the control requires correct certificate validation procedures.

SC-17 Public Key Infrastructure Certificates

addresses: CWE-295

Mandates approved trust anchors and issuance policies, directly preventing acceptance of unvalidated or untrusted certificates.

SC-45 System Time Synchronization

addresses: CWE-295

Correct system time is required for proper enforcement of certificate notBefore/notAfter dates and time-based revocation checks.

MITRE ATT&CK Enterprise TechniquesAI

T1557 Adversary-in-the-Middle Credential Access

Adversaries may attempt to position themselves between two or more networked devices using an adversary-in-the-middle (AiTM) technique to support follow-on behaviors such as [Network Sniffing](https://attack.

attack.mitre.org →

Why these techniques?

Improper certificate validation (CWE-295) directly enables an on-path attacker to perform adversary-in-the-middle interception or manipulation of Zoom traffic, matching T1557.

Confidence: MEDIUM · MITRE ATT&CK Enterprise v18.1

NVD Description

Improper certificate validation in Zoom Workplace for Linux before version 6.4.13 may allow an unauthorized user to conduct an information disclosure via network access.

Deeper analysisAI

CVE-2025-46788 is an improper certificate validation vulnerability affecting Zoom Workplace for Linux versions prior to 6.4.13. This flaw, classified under CWE-295, enables potential information disclosure through network access due to inadequate verification of certificates during communication. The vulnerability carries a CVSS v3.1 base score of 7.4 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N), indicating high confidentiality and integrity impacts with high attack complexity but no requirement for privileges or user interaction.

An attacker with network access to a vulnerable Zoom Workplace for Linux installation could exploit this issue to conduct information disclosure. By leveraging the improper certificate validation, an unauthorized user might intercept or manipulate communications, potentially exposing sensitive data and compromising the integrity of sessions without disrupting availability.

Zoom's security bulletin (ZSB-25023) at https://https://www.zoom.com/en/trust/security-bulletin/zsb-25023/ addresses this vulnerability, recommending an upgrade to Zoom Workplace for Linux version 6.4.13 or later as the primary mitigation to properly enforce certificate validation.