CVE-2020-11500
HIGHCVSS 7.5/10EPSS 1.31%
Last modified
CVE-2020-11500 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. Zoom Client for Meetings through 4.6.9 uses the ECB mode of AES for video and audio encryption. Within a meeting, all participants use a single 128-bit key.. EPSS estimates a 1.31% chance of exploitation in the next 30 days.
Description
Zoom Client for Meetings through 4.6.9 uses the ECB mode of AES for video and audio encryption. Within a meeting, all participants use a single 128-bit key.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Zoom | Meetings | <= 4.6.9 |
References
- https://citizenlab.ca/2020/04/move-fast-roll-your-own-crypto-a-quick-look-at-the-confidentiality-of-zoom-meetings/Exploit, Third Party Advisory
- https://theintercept.com/2020/04/03/zooms-encryption-is-not-suited-for-secrets-and-has-surprising-links-to-china-researchers-discover/Press/Media Coverage, Third Party Advisory
- https://citizenlab.ca/2020/04/move-fast-roll-your-own-crypto-a-quick-look-at-the-confidentiality-of-zoom-meetings/Exploit, Third Party Advisory
- https://theintercept.com/2020/04/03/zooms-encryption-is-not-suited-for-secrets-and-has-surprising-links-to-china-researchers-discover/Press/Media Coverage, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2020-11500?
Zoom Client for Meetings through 4.6.9 uses the ECB mode of AES for video and audio encryption. Within a meeting, all participants use a single 128-bit key.
How severe is CVE-2020-11500?
CVE-2020-11500 has a CVSS score of 7.5/10 (HIGH severity). The EPSS model estimates a 1.31% probability of exploitation in the next 30 days.
How do I fix CVE-2020-11500?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2020
- CVE-2020-11495Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
- CVE-2020-11496Sprecher SPRECON-E firmware prior to 8.64b might allow local…6.7
- CVE-2020-11497An issue was discovered in the NAB Transact extension 2.1.0 …7.5
- CVE-2020-11498Slack Nebula through 1.1.0 contains a relative path vulnerab…8.8
- CVE-2020-11499Firmware Analysis and Comparison Tool (FACT) 3 has Stored XS…6.1
- CVE-2020-1150A memory corruption vulnerability exists when Windows Media …7.8
- CVE-2020-11501GnuTLS 3.6.x before 3.6.13 uses incorrect cryptography for D…7.4
- CVE-2020-11503A heap-based buffer overflow in the awarrensmtp component of…9.8
- CVE-2020-11505An issue was discovered in GitLab Community Edition (CE) and…7.5
- CVE-2020-11506An issue was discovered in GitLab 10.7.0 and later through 1…7.5
- CVE-2020-11507An Untrusted Search Path vulnerability in Malwarebytes AdwCl…7.8
- CVE-2020-11508An XSS vulnerability in the WP Lead Plus X plugin through 0.…5.4
Are you affected by CVE-2020-11500?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST