Detections
Analytics

Zscaler Client Connector < 4.2.0.190 Multiple Vulnerabilities

high Nessus Plugin ID 265426

Language:

Synopsis

Zscaler Client Connector installed on remote Windows host is affected by multiple vulnerabilities

Description

The version of Zscaler Client Connector installed on the remote Windows host is prior to 4.2.0.190. It is, therefore, affected by multiple vulnerabilities.

 - An Improper Validation of signature in Zscaler Client Connector on Windows allows an authenticated user to disable anti-tampering. This issue affects Client Connector on Windows < 4.2.0.190. (CVE-2023-28806)

 - Anti-tampering can be disabled under certain conditions without signature validation. This affects Zscaler Client Connector < 4.2.0.190 with anti-tampering enabled. (CVE-2024-23456)

 - While copying individual autoupdater log files, reparse point check was missing which could result into crafted attacks, potentially leading to a local privilege escalation. This issue affects Zscaler Client Connector on Windows < 4.2.0.190. (CVE-2024-23458)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Upgrade to Zscaler Client Connector version 4.2.0.190 or later.

See Also

http://www.nessus.org/u?70a8c00b

Plugin Details

Severity: High

ID: 265426

File Name: zscaler_client_connector-4_2_0_190.nasl

Version: 1.1

Type: local

Agent: windows

Family: Windows

Published: 9/19/2025

Updated: 9/19/2025

Supported Sensors: Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 5.9

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Vector: CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2024-23458

CVSS v3

Risk Factor: High

Base Score: 7.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS Score Source: CVE-2024-23458

Vulnerability Information

CPE: cpe:/a:zscaler:client_connector

Required KB Items: SMB/Registry/Enumerated, installed_sw/Zscaler Client Connector

Patch Publication Date: 8/6/2024

Vulnerability Publication Date: 8/6/2024

Reference Information

CVE: CVE-2023-28806, CVE-2024-23456, CVE-2024-23458

IAVB: 2024-B-0102