CVE-2023-41970 is a medium severity (CVSS 6.0) improper validation of an integrity check value in Zscaler Client Connector on Windows, during the Repair App function. It may allow local code execution. Versions before 4.1.0.62 are affected, so update to 4.1.0.62 or later.
What's affected
The NVD record says Client Connector on Windows before 4.1.0.62 is affected. The flaw is in the Repair App functionality, and the record says it may allow local execution of code.
The Zscaler release summary linked from the record could not be read by our automated request, so we could not confirm the release note text. Check it for the exact scope.
The record scores the flaw 6.0 (Medium) with the vector CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:L. It can be reached with local access to the machine, the attack complexity is high, it requires high privileges (an administrator account), and it needs no user interaction. The impact on confidentiality is high, on integrity high and on availability low. The weakness class is CWE-354 (improper validation of integrity check value). The record does not mark this CVE as being in the CISA Known Exploited Vulnerabilities catalog, and nothing we read says it is exploited in the wild.
How to check if you're exposed
Open the Zscaler Client Connector app on a Windows machine and read the version. Anything before 4.1.0.62 should be updated. Your Zscaler admin portal can list client versions across devices.
The vector shows high privileges are needed, so the practical exposure is on machines where an administrator-level account could be abused or compromised.
What to do now
- List Windows machines on Client Connector before 4.1.0.62.
- Update to 4.1.0.62 or later, or to a current release.
- Read the Zscaler release summary for the details.
- Limit who has local administrator rights.
Why it matters
The weakness is CWE-354, improper validation of an integrity check value. A repair routine did not check strictly enough that the files it used were genuine, so a changed file could be accepted and run. Integrity checks exist to stop exactly that.
The vector rates complexity high and requires high privileges, which is why this stays at medium. It is still a case where a trusted security agent could be steered to run code, so keep endpoint clients current. Treat the client like any other privileged software on the machine: track its version centrally, and review how updates reach laptops that are rarely on the corporate network.
Quick check
Does it need administrator rights?
The vector shows high privileges required and a local attack path.
Which version fixes it?
The record says versions before 4.1.0.62 are affected, so 4.1.0.62 or later.
Sources
- Zscaler Client Connector 2022 release summary, version 4.1 (linked from the record; not retrieved)
- CVE-2023-41970 on Gold
Last reviewed: 19 October 2026.
