A command injection flaw in Zoom Node Multimedia Routers (MMRs) allows a meeting participant with network access to execute arbitrary commands on the device. The vulnerability resides in input handling that is not properly sanitized, giving the attacker control over system command execution, which can lead to full compromise of the MMR, including data exfiltration, service disruption, or further attacks against connected infrastructure.

Zoom Communications Inc. Zoom Node-MMR devices with firmware versions earlier than 5.2.1716.0 are affected. Any deployment that has not been updated to at least this version is vulnerable.

The flaw is assigned a CVSS score of 9.9, indicating a critical severity. The EPSS score is below 1%, suggesting low current exploitation probability, and the issue is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is a network-based attack that a meeting participant can perform after joining the session, exploiting the insufficient input validation to inject malicious commands.