CVE-2025-67460 Overview
CVE-2025-67460 is a protection mechanism failure affecting Zoom Rooms for Windows before version 6.6.0. The flaw permits software downgrade attacks that bypass built-in security controls. An authenticated local user can leverage the weakness to escalate privileges on affected systems.
Zoom disclosed the issue in security bulletin ZSB-25050. The vulnerability is tracked under CWE-693 (Protection Mechanism Failure), a class of weaknesses where a security control fails to prevent the condition it was designed to stop.
Critical Impact
A local attacker with low privileges can downgrade Zoom Rooms to an earlier vulnerable version and abuse known flaws to gain elevated privileges on the Windows host.
Affected Products
- Zoom Rooms for Windows versions prior to 6.6.0
- Deployments running on any supported Windows platform hosting the Zoom Rooms client
- Managed conference room endpoints and dedicated Zoom Rooms appliances running Windows
Discovery Timeline
- 2025-12-10 - CVE-2025-67460 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-67460
Vulnerability Analysis
Zoom Rooms for Windows enforces version integrity to prevent installation of older builds that contain previously patched security flaws. CVE-2025-67460 undermines that control. The downgrade protection mechanism fails to reject or block the installation of an older Zoom Rooms build.
Because the attack requires local access and low privileges, an adversary who has already gained a foothold on the endpoint is the most likely exploiter. Successful downgrade re-exposes vulnerabilities that Zoom fixed in prior releases. The attacker then chains the downgrade with a known privilege escalation flaw to execute code with higher privileges.
The issue impacts confidentiality, integrity, and availability of the affected host because privilege escalation on Windows typically yields SYSTEM-level control.
Root Cause
The root cause is an incomplete or absent version-integrity check during the update or installation flow. The application does not adequately verify that a candidate installer represents a newer or equal build compared to the currently installed version. Downgrade prevention logic exists but does not block all downgrade paths, satisfying the definition of CWE-693.
Attack Vector
Exploitation requires local access to the Windows system running Zoom Rooms. The attacker supplies an older, vulnerable Zoom Rooms installer and invokes the update or install workflow. Once the downgrade succeeds, the attacker triggers a previously patched vulnerability in the older build to escalate privileges. No user interaction is required beyond the initial local access.
No public proof-of-concept exploit is available at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Detection Methods for CVE-2025-67460
Indicators of Compromise
- Unexpected downgrade of the Zoom Rooms executable version reported by installed software inventory
- Presence of Zoom Rooms installer binaries with versions below 6.6.0 on managed endpoints
- Zoom Rooms services or processes launching from paths associated with older build layouts
- Unusual child processes spawned by Zoom Rooms components running with elevated privileges
Detection Strategies
- Compare current Zoom Rooms build numbers against the approved baseline 6.6.0 or later across the fleet
- Alert on installer execution events (msiexec.exe, custom Zoom installers) that reference legacy Zoom Rooms MSI or EXE packages
- Monitor Windows event logs for MSI install and uninstall events targeting the Zoom Rooms product code
- Correlate downgrade activity with subsequent privilege escalation indicators such as new local admin account creation or SYSTEM-context process spawns
Monitoring Recommendations
- Enable software inventory reporting and flag any regression in the Zoom Rooms version string
- Ingest endpoint process telemetry into a centralized data lake to hunt for downgrade-then-exploit patterns
- Track file writes to Zoom Rooms installation directories under C:\Program Files\Zoom Rooms\ for unauthorized modifications
How to Mitigate CVE-2025-67460
Immediate Actions Required
- Upgrade all Zoom Rooms for Windows installations to version 6.6.0 or later without delay
- Inventory endpoints running Zoom Rooms and identify any hosts still on vulnerable builds
- Restrict local administrative access on Zoom Rooms hosts to reduce the pool of users who can trigger downgrade attempts
- Review recent installer activity on Zoom Rooms endpoints for signs of unauthorized rollback
Patch Information
Zoom addressed CVE-2025-67460 in Zoom Rooms for Windows version 6.6.0. Refer to the Zoom Security Bulletin ZSB-25050 for the official advisory, affected version ranges, and download links for the fixed release.
Workarounds
- Enforce application allowlisting to block execution of unauthorized Zoom Rooms installer versions
- Remove local administrator rights from standard users on Zoom Rooms endpoints
- Configure endpoint protection policies to alert on execution of older Zoom Rooms MSI packages until patching is complete
- Isolate Zoom Rooms appliances on a dedicated network segment to limit lateral access from compromised user workstations
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
