CVE-2023-28602

HighCVSS 7.7/10Last modified Jun 17, 2026

Description

Zoom for Windows clients prior to 5.13.5 contain an improper verification of cryptographic signature vulnerability. A malicious user may potentially downgrade Zoom Client components to previous versions.

Metrics

CVSS 3.1 7.7/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N

Weakness enumeration

CWE-347

Affected software

VendorProductVersions
Zoom Video Communications, Inc.Zoom for Windows Clientbefore 5.13.5

References

Timeline

Published
Jun 13, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-286037.1Zoom VDI client installer prior to 5.14.0 contains an improper access control vulnerability. A malicious user may potentially delete localCVE-2023-286046.1The fluid_components (aka Fluid Components) extension before 3.5.0 for TYPO3 allows XSS via a component argument parameter, for certain {conCVE-2023-286066.1js/event-graph.js in MISP before 2.4.169 allows XSS via event-graph node tooltips.CVE-2023-286076.1js/event-graph.js in MISP before 2.4.169 allows XSS via the event-graph relationship tooltip.CVE-2023-286099.8api/auth.go in Ansible Semaphore before 2.8.89 mishandles authentication.CVE-2023-28617.1A flaw was found in the 9p passthrough filesystem (9pfs) implementation in QEMU. The 9pfs server did not prohibit opening special files on tCVE-2023-286109.8The update process in OMICRON StationGuard and OMICRON StationScout before 2.21 can be exploited by providing a modified firmware update imaCVE-2023-286119.8Incorrect authorization in OMICRON StationGuard 1.10 through 2.20 and StationScout 1.30 through 2.20 allows an attacker to bypass intended aCVE-2023-286139.8An issue was discovered in Samsung Exynos Mobile Processor and Baseband Modem Processor for Exynos 1280, Exynos 2200, and Exynos Modem 5300.CVE-2023-286149.8Freewill iFIS (aka SMART Trade) 20.01.01.04 allows OS Command Injection via shell metacharacters to a report page.CVE-2023-286167.5An issue was discovered in Stormshield Network Security (SNS) before 4.3.17, 4.4.x through 4.6.x before 4.6.4, and 4.7.x before 4.7.1. It afCVE-2023-286177.8org-babel-execute:latex in ob-latex.el in Org Mode through 9.6.1 for GNU Emacs allows attackers to execute arbitrary commands via a file nam