ManageEngine Endpoint Central CVE-2025-11248

Requires a valid authenticated account on ManageEngine Endpoint Central with the ability to read or export the product's logs (per CVSS PR:L); it is not remotely exploitable by an unauthenticated attacker. The sensitive agent token must actually be present in those logs, which occurs on affected builds prior to 11.4.2528.05. Limiting factors: authentication is mandatory, the exposure is confined to log readers, and value to the attacker depends on what the recovered agent token can authorize. Upgrading to 11.4.2528.05 or later removes the token from the logs.

This is a moderate, not high-priority, issue. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, base 4.3) is internally consistent with the description: exploitation requires an already-authenticated user (PR:L) with access to the product's logs, and the only impact is limited confidentiality (C:L) - disclosure of a sensitive agent token, with no integrity or availability impact. The EPSS score of 0.52% (42nd percentile) indicates low predicted exploitation probability, consistent with a low-severity, authentication-gated information-disclosure flaw rather than a mass-exploited remote code execution bug. There is no CISA KEV listing and no public POC in the provided data, so exploitation status is: no public exploit identified at time of analysis. No SSVC decision data was supplied. One nuance worth flagging: the real-world severity depends on what the leaked agent token can subsequently authorize - if that token grants broad agent/server control, the practical downstream impact could exceed the C:L base score, but this is not confirmed in the available data and should be verified against the vendor advisory. All signals point to this being a genuine but low-urgency hardening fix.

An attacker who already holds a low-privileged authenticated account on the Endpoint Central console (or who has compromised such an account) browses or exports the application logs and recovers a sensitive agent token written there in cleartext. The attacker could then attempt to reuse that token to impersonate or interact with managed agents. No public exploit code is known, and exploitation first requires valid authenticated access to the logs.