CVE-2024-24694: 
NixOS vulnerability analysis and mitigation

A privilege management vulnerability was identified in the Zoom Desktop Client for Windows installer, affecting versions prior to 5.17.10. The vulnerability, tracked as CVE-2024-24694, was discovered and reported by sim0nsecurity. The issue was officially disclosed on April 9, 2024, and affects the installation process of the Zoom Desktop Client for Windows (Zoom Bulletin).

The vulnerability has been assigned a CVSS v3.1 base score of 5.9 (Medium severity) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N. This indicates that the vulnerability requires local access, low attack complexity, low privileges, and user interaction to exploit, with the potential for high impact on integrity in a changed scope scenario (Zoom Bulletin).

The vulnerability could potentially allow an authenticated user with local access to perform privilege escalation attacks through the Windows client installer. This could lead to unauthorized elevation of privileges on affected systems (Zoom Bulletin).

The vulnerability requires local access and user interaction to exploit. As of current reports, no known exploits have been observed in the wild (ManageEngine).

Users are advised to update their Zoom Desktop Client for Windows to version 5.17.10 or later. The update is available through the official Zoom download page at https://zoom.us/download. This update addresses the privilege management vulnerability and helps maintain system security (Zoom Bulletin).