CVE-2020-11876: 
Zoom Client vulnerability analysis and mitigation

CVE-2020-11876 is a disputed vulnerability discovered in Zoom Client for Meetings version 4.6.11, specifically affecting the airhost.exe component. The vulnerability was initially reported on April 17, 2020, and involves the use of a SHA-256 hash for initialization of an OpenSSL EVP AES-256 CBC context. The vendor has disputed this vulnerability, stating that the affected code is unreachable (NVD).

The vulnerability relates to cryptographic implementation in the airhost.exe component of Zoom Client for Meetings 4.6.11. It has been assigned a CVSS v3.1 base score of 7.5 (High) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. The issue has been classified under CWE-327 (Use of a Broken or Risky Cryptographic Algorithm) (NVD).

Based on the CVSS score and vector string, the vulnerability could potentially lead to unauthorized access to confidential information. However, given that the vendor disputes the vulnerability and states the affected code is unreachable, the actual impact may be minimal (NVD).

While the vulnerability has been assigned a high CVSS score indicating potential network-based exploitation with low complexity and no required privileges, the disputed nature of the vulnerability and the vendor's statement about unreachable code suggests limited real-world exploitability (NVD).

Given that this is a disputed vulnerability with the vendor stating the affected code is unreachable, no specific mitigation steps have been published. However, as general best practice, users should ensure they are running the latest version of the Zoom Client for Meetings software (NVD).