CVE-2021-30480 json
Zoom Chat through 2021-04-09 on Windows and macOS allows certain remote authenticated attackers to execute arbitrary code without user inte…
published 2021-04-09 5 y ago modified 2026-06-17 4 mo ago also EUVD-2021-17403
- cvss
- 8.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 7.2%
- EPSS 7.2% chance of exploitation in 30 days, percentile 94%
- public exploits
- 0
- none known
Summary
Zoom Chat through 2021-04-09 on Windows and macOS allows certain remote authenticated attackers to execute arbitrary code without user interaction. An attacker must be within the same organization, or an external party who has been accepted as a contact. NOTE: this is specific to the Zoom Chat software, which is different from the chat feature of the Zoom Meetings and Zoom Video Webinars software.
Exploit prediction
7.21% chance of exploitation in the next 30 days, higher than 94% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- sector7.computest.nl https://sector7.computest.nl/post/2021-08-zoom/ referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 8.5 | CVSS:3.1/AC:H/AV:N/A:H/C:H/I:H/PR:L/S:C/UI:N |
| CNA | 3.1 | 8.5 | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H |
| NVD | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 9.0 | AV:N/AC:L/Au:S/C:C/I:C/A:C |
References
-
sector7.computest.nl
/post/2021-08-zoom/
exploit, third-party-advisory
-
zoom.us
/feature/messaging
product, vendor-advisory
-
explore.zoom.us
/en/trust/security/security-bulletin/
vendor-advisory
-
blog.malwarebytes.com
/exploits-and-vulnerabilities/2021/04/zoom-zero-day-discovery-makes-calls-safer-hackers-200000-richer/
third-party-advisory
-
twitter.com
/thezdi/status/1379855435730149378
third-party-advisory
-
twitter.com
/thezdi/status/1379859851061395459
third-party-advisory
-
securityweek.com
/200000-awarded-zero-click-zoom-exploit-pwn2own
press/media-coverage, third-party-advisory
-
zdnet.com
/article/critical-zoom-vulnerability-triggers-remote-code-execution-without-user-input/
press/media-coverage, third-party-advisory
-
zerodayinitiative.com
/advisories/ZDI-21-971/
third-party-advisory, vdb-entry
Sources
- CVE List CVE-2021-30480
- NVD CVE-2021-30480
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.