Insufficient verification of data authenticity in the Remote Control component of Zoom Contact Center for Windows enables an authenticated local attacker to manipulate control settings and gain higher privileges. This flaw allows a user with legitimate access to the application to execute actions that normally require elevated rights, potentially leading to unauthorized configuration changes or system compromise. The weakness is tied to CWE-345, involving the failure to verify the integrity of the data used for controlling access rights.

Zoom Communications Remote Control for Zoom Contact Center on Windows versions prior to 7.0.0 are affected. Users running any older release should consider this product version vulnerable until updated.

The CVSS v3.1 score of 7.8 indicates a high severity for an authenticated local privilege escalation. No EPSS score is currently available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be local, requiring the attacker to be logged into the system and have access to the Zoom Contact Center application. Because the flaw leverages locally privileged users, the window for exploitation is limited to environments where such users exist, but the potential impact remains considerable if privileged accounts are compromised.