CVE-2023-28806: 
Zscaler Client Connector vulnerability analysis and mitigation

CVE-2023-28806 is a security vulnerability affecting Zscaler Client Connector on Windows versions prior to 4.2.0.190. The vulnerability was disclosed on August 6, 2024, and involves an improper validation of signature that allows an authenticated user to disable anti-tampering functionality (NVD).

The vulnerability is classified as CWE-347 (Improper Verification of Cryptographic Signature) with a CVSS v3.1 base score of 6.5 (Medium) according to NIST's assessment, and 5.7 (Medium) according to Zscaler's assessment. The CVSS vector string is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, indicating network accessibility, low attack complexity, and requiring low privileges (NVD).

If exploited, this vulnerability allows an authenticated user to disable the anti-tampering protection mechanisms in the Zscaler Client Connector. This could potentially compromise the security integrity of the affected systems by allowing unauthorized modifications to security settings (NVD).

The vulnerability requires an authenticated user with local access to exploit. The attack complexity is considered low, but it requires low-level privileges to execute. No public exploits or active exploitation in the wild have been reported (NVD).

The vulnerability has been patched in Zscaler Client Connector version 4.2.0.190 for Windows. Organizations are advised to upgrade to this version or later to address the security issue (Zscaler Advisory).