CVE-2023-41973 is a high severity flaw (CVSS 7.3) in Zscaler Client Connector for Windows. The NVD record says ZSATray passes a previous installer name to TrayManager, which appends it to build the path of an executable. Zscaler lists Win ZApp 4.3.0.121 and later as fixed.
What's affected
The record covers Zscaler Client Connector on Windows. The fix is stated in the description as "Win ZApp 4.3.0.121 and later." Earlier Windows releases should be treated as affected until the vendor release summary says otherwise.
The CVSS 3.1 vector is AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L. That means local access, low privileges, no user interaction, and high confidentiality and integrity impact. The weakness is CWE-22, a path traversal class.
The description is brief. It names the components involved, ZSATray and TrayManager, and the parameter, previousInstallerName. It does not say how an attacker would influence that value or what the resulting file would be used for, so this post does not guess.
How to check if you're exposed
Read the installed Client Connector version on each Windows machine, from the app's About view or from the registry:
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*",
"HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*" |
Where-Object { $_.DisplayName -like "*Zscaler*" } |
Select-Object DisplayName, DisplayVersion
Compare each version with 4.3.0.121. If your fleet is managed from the Zscaler admin portal, use its device version report to get a fleet wide count.
What to do now
- Inventory Windows endpoints with Client Connector below 4.3.0.121.
- Roll out 4.3.0.121 or later through your software deployment tool.
- Read the vendor release summary for the release date and any notes on this fix.
- Limit local administrator and shared account use on affected machines until they are updated.
- Log the change against your asset records.
Why it matters
Path traversal bugs occur when a value that should name a file is joined onto a directory path without being constrained. Here the value is combined into the full path of an executable, and executables are the kind of file a privileged process may go on to run. The record stops short of saying that happens, so the practical lesson is narrower: any time an agent builds a path from a configuration value, that value needs to be checked.
The vector needs local access, so the exposure is about shared or loosely managed Windows machines rather than internet reachable systems. The record's KEV flag is false.
Because this is a desktop agent, it will not appear in a dependency scan of your repositories. Use endpoint inventory for it. For the software you do build and ship, the free in-browser dependency scan and reachability analysis help you separate libraries that are present from those that are actually used.
Quick check
Is the whole Zscaler platform affected?
The record names the Windows Client Connector only, with the fix in Win ZApp 4.3.0.121 and later. It does not name other Zscaler products.
Is there a workaround?
The record gives none. Upgrading is the stated remedy, and tightening local access on shared machines reduces exposure in the meantime.
Sources
- NVD record for CVE-2023-41973
- Zscaler Client Connector 2023 release summary (returned no readable content when fetched, so the fixed version is taken from the NVD description)
Last reviewed: 19 October 2026.
