CVE-2025-62483: 
Zoom Rooms vulnerability analysis and mitigation

CVE-2025-62483 is an information disclosure vulnerability caused by improper removal of sensitive information in certain Zoom client products before version 6.5.10. An unauthenticated remote attacker can exploit this flaw via network access to obtain sensitive information. Affected products include Zoom Workplace Desktop (Windows, macOS, Linux), Zoom Rooms (Windows, macOS, iOS), Zoom Rooms Controller (Windows, macOS, Linux), Zoom Meeting SDK (Windows, macOS, Linux), and Zoom Workplace VDI (Windows, before 6.3.14 or 6.4.10–6.4.12). The vulnerability was disclosed by Zoom on November 11, 2025, and published to NVD on November 13, 2025. NIST NVD assigns a CVSS v3.1 base score of 7.5 (High), while Zoom's own CNA assessment is 5.3 (Medium) (Zoom Advisory).

The root cause is classified as CWE-212 (Improper Removal of Sensitive Information Before Storage or Transfer), meaning the affected Zoom clients fail to adequately sanitize or strip sensitive data before it is transmitted over the network. This allows a network-positioned unauthenticated attacker to intercept or otherwise access sensitive information that should have been removed prior to transfer. No user interaction or authentication is required, and the attack complexity is low. No public technical write-ups or proof-of-concept code have been identified at this time (Zoom Advisory).

Successful exploitation results in a high confidentiality impact — sensitive information may be disclosed to unauthenticated remote attackers via network access. There is no impact to integrity or availability. The broad scope of affected products (desktop clients, room systems, SDK, and VDI environments across Windows, macOS, Linux, and iOS) means the potential exposure is wide, particularly in enterprise environments where Zoom is heavily used (Zoom Advisory).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported for CVE-2025-62483. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.029% (0.000290), indicating a very low probability of exploitation in the near term. Nessus detection plugins (IDs 274734, 274735, 274736) are available for identifying vulnerable systems (Zoom Advisory).

Zoom has released patched versions addressing this vulnerability. Users should update to Zoom Workplace Desktop, Zoom Rooms, Zoom Rooms Controller, and Zoom Meeting SDK version 6.5.10 or later on all platforms (Windows, macOS, Linux, iOS). For Zoom Workplace VDI on Windows, update to version 6.3.14 or later (for versions before 6.4.10), or to 6.4.12 or later (for versions 6.4.10 and above). Updates are available at https://zoom.us/download. No configuration-based workarounds have been published; upgrading is the recommended remediation (Zoom Advisory).

The vulnerability received routine coverage in weekly threat landscape digests and vulnerability aggregation platforms. No notable independent researcher commentary or significant social media discussion has been identified beyond standard advisory republication (Hawk-Eye Digest).