CVE-2025-0149

MEDIUM

Published Mar 11, 2025 Modified Aug 19, 2025 CWE-345

Description

Insufficient verification of data authenticity in some Zoom Workplace Apps may allow an unprivileged user to conduct a denial of service via network access.

Is your site exposed to CVE-2025-0149?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

6.5

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Weakness Type (CWE)

CWE-345 CWE-345

Affected Products

Vendor	Product	Versions
zoom	meeting_software_development_kit	< 6.3.0
zoom	meeting_software_development_kit	< 6.3.0
zoom	meeting_software_development_kit	< 6.3.0
zoom	meeting_software_development_kit	< 6.3.0
zoom	meeting_software_development_kit	< 6.3.0
zoom	rooms	< 6.3.0
zoom	rooms	< 6.3.0
zoom	rooms	< 6.3.0
zoom	rooms	< 6.3.0
zoom	rooms_controller	< 6.3.0
zoom	rooms_controller	< 6.3.0
zoom	rooms_controller	< 6.3.0
zoom	rooms_controller	< 6.3.0
zoom	workplace	< 6.3.0
zoom	workplace	< 6.3.0
zoom	workplace_desktop	< 6.3.0
zoom	workplace_desktop	< 6.3.0
zoom	workplace_desktop	< 6.3.0
zoom	workplace_virtual_desktop_infrastructure	< 6.1.15
zoom	workplace_virtual_desktop_infrastructure	6.1.16 — 6.2.10

References

Advisories & Patches

https://www.zoom.com/en/trust/security-bulletin/zsb-25008/

Frequently Asked Questions

What is CVE-2025-0149? +

Insufficient verification of data authenticity in some Zoom Workplace Apps may allow an unprivileged user to conduct a denial of service via network access. It has a CVSS v3.1 base score of 6.5 (MEDIUM).

How severe is CVE-2025-0149? +

CVE-2025-0149 has a CVSS v3.1 score of 6.5 out of 10, rated MEDIUM. This is a medium-severity vulnerability that should be remediated as part of regular maintenance.

What products are affected by CVE-2025-0149? +

CVE-2025-0149 affects products from zoom, specifically: meeting_software_development_kit, rooms, rooms_controller, workplace, workplace_desktop, workplace_virtual_desktop_infrastructure. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2025-0149? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-62995

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. in versions …

CVE-2026-53536

Activepieces is an open source AI workflow automation platform. Prior to 0.83.0, the /v1/step-files/signed download endpoint verified the supplied JWT …

CVE-2026-45022

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.0 and 6.0.0-alpha.3, go-git may parse malformed …

CVE-2026-42206

Roadiz is a polymorphic content management system based on a node system. Prior to versions 2.3.43, 2.5.45, 2.6.31, and 2.7.18, …

CVE-2026-47202

Kavita is a cross platform reading server. Prior to 0.9.0.2, an Improper Token validation flaw permits a remote and unauthenticated …

CVE-2025-21606

stats is a macOS system monitor in for the menu bar. The Stats application is vulnerable to a local privilege …