CVE-2024-23462: client connector — Fix

Description

An Improper Validation of Integrity Check Value vulnerability in Zscaler Client Connector on MacOS allows a denial of service of the Client Connector binary and thus removing client functionality.This issue affects Client Connector on MacOS: before 3.4.

Is your site exposed to CVE-2024-23462?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

3.3

LOW

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Weakness Type (CWE)

CWE-354 CWE-354

Affected Products

Vendor	Product	Versions
zscaler	client_connector	< 3.4

References

Advisories & Patches

https://help.zscaler.com/zscaler-client-connector/client-connector-app-release-summary-2021?applicable_category=macos&applicable_version=3.4 https://help.zscaler.com/zscaler-client-connector/client-connector-app-release-summary-2021?applicable_category=macos&applicable_version=3.4

Frequently Asked Questions

What is CVE-2024-23462? +

An Improper Validation of Integrity Check Value vulnerability in Zscaler Client Connector on MacOS allows a denial of service of the Client Connector binary and thus removing client functionality.This issue affects Client Connector on MacOS: before 3.4. It has a CVSS v3.1 base score of 3.3 (LOW).

How severe is CVE-2024-23462? +

CVE-2024-23462 has a CVSS v3.1 score of 3.3 out of 10, rated LOW. This is a low-severity vulnerability with limited impact.

What products are affected by CVE-2024-23462? +

CVE-2024-23462 affects products from zscaler, specifically: client_connector. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2024-23462? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-113714

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, download_wheel() writes package-index downloads directly into the …

CVE-2026-16001

Exposure of the message authentication key through the encryption keystream in the stream mode of IesEngine (an IesEngine constructed without …

CVE-2026-93317

An unauthenticated attacker controlling a registry or OCI-layout blob source could provide blob contents that did not match the claimed …

CVE-2026-15999

Improper validation of integrity check value in the AES-CCM implementation (CcmParameters and CcmBlockCipher) in Legion of the Bouncy Castle Inc. …

CVE-2026-84900

Previous versions of HP ThinPro (prior to HP ThinPro 8.1 SP10) could potentially contain security vulnerabilities. HP has released HP …

CVE-2026-75803

Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty ciphertext can report success without verifying the supplied authentication tag when …

CVE-2024-23462