This vulnerability in DigitalME eRoom (up to version 1.5.6) involves the insertion of sensitive information into data sent during Zoom meetings and webinars, which can be retrieved by an attacker. The CVSS vector indicates the attack requires network access, high attack complexity, no privileges, and user interaction, with impacts on confidentiality, integrity, and availability rated as low to low and low respectively. The issue is published and tracked under CVE-2025-49919 but lacks detailed vendor advisory or patch information.

An attacker could potentially retrieve sensitive embedded data from sent communications within the affected eRoom product, leading to partial confidentiality, integrity, and availability impacts. The vulnerability requires user interaction and has a high attack complexity, reducing the likelihood of exploitation. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or workaround is provided, users should monitor for updates from DigitalME and apply any official fixes once available. Until then, exercising caution with eRoom Zoom meetings and webinars and limiting sensitive data transmission through this channel is advisable.