« Volver al listado

CVE-2025-49463

Estado: AnalizadaMedia (6.5)—

Insufficient control flow management in certain Zoom Clients for iOS before version 6.4.5 may allow an unauthenticated user to conduct a disclosure of information via network access.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Zoom — Zoom

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-49463",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-49463",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-07-10T18:03:03.922715Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security@zoom.us",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security@zoom.us",
      "affectedData": [
        {
          "vendor": "Zoom Communications Inc.",
          "product": "Zoom Clients for iOS",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "6.4.5",
              "versionType": "custom"
            }
          ],
          "platforms": [
            "iOS"
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-07-10T17:15:47.747",
  "references": [
    {
      "url": "https://https://www.zoom.com/en/trust/security-bulletin/zsb-25026/",
      "tags": [
        "Broken Link",
        "Vendor Advisory"
      ],
      "source": "security@zoom.us"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@zoom.us",
      "description": [
        {
          "lang": "en",
          "value": "CWE-691"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Insufficient control flow management in certain Zoom Clients for iOS before version 6.4.5 may allow an unauthenticated user to conduct a disclosure of information via network access."
    },
    {
      "lang": "es",
      "value": "La gestión insuficiente del flujo de control en ciertos clientes Zoom para iOS anteriores a la versión 6.4.5 puede permitir que un usuario no autenticado realice una divulgación de información a través del acceso a la red."
    }
  ],
  "lastModified": "2026-06-17T09:31:21.193",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:zoom:zoom:*:*:*:*:*:iphone_os:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0D217CCD-8DD8-46F5-9141-7A6477012996",
              "versionEndExcluding": "6.4.5"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@zoom.us"
}