CVE-2020-11877: 
Zoom Client vulnerability analysis and mitigation

A vulnerability was identified in Zoom Client for Meetings version 4.6.11, specifically in the airhost.exe component. The vulnerability (CVE-2020-11877) involves the use of a static Initialization Vector (IV) value '3423423432325249' for AES-256 CBC encryption. This vulnerability has been disputed by the vendor, who states that the affected code is unreachable (NVD).

The vulnerability relates to cryptographic implementation, specifically the use of a hardcoded Initialization Vector (IV) in AES-256 CBC encryption mode. The CVSS v3.1 base score is 7.5 (High), with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. The vulnerability is classified under CWE-330 (Use of Insufficiently Random Values) (NVD).

Based on the CVSS score and vector, the vulnerability could potentially lead to confidentiality breaches if successfully exploited. However, the impact is mitigated by the vendor's assertion that the vulnerable code is unreachable (NVD).

While the vulnerability has been assigned a high CVSS score indicating relatively easy exploitation (Network accessible with Low complexity), the vendor's dispute about code reachability significantly affects the practical exploitability of this vulnerability (NVD).

The vulnerability has been addressed in later versions of Zoom Client for Meetings. Users are advised to upgrade to the latest version of the software (ManageEngine).