ManageEngine Endpoint Central CVE-2025-5494

Exploitation requires the attacker to already have local, authenticated low-privilege code execution on a host where the ManageEngine Endpoint Central agent is installed and running (PR:L, AV:L, UI:N); it cannot be triggered remotely or by an unauthenticated actor. The vulnerable component is specifically the agent setup/installation privilege handling, so only endpoints with the Endpoint Central agent deployed are affected - servers running only the Endpoint Central management console without a local agent, or hosts not enrolled in Endpoint Central, are not exposed via this vector. The limiting factors are the mandatory pre-existing local foothold and the requirement that the vulnerable agent build (through 11.4.2500.25 / through 11.4.2508.13) be present; no user interaction is required once local access is held.

This is a locally-exploitable privilege escalation (CWE-269) in the Endpoint Central agent, and the provided CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8 HIGH) is internally consistent with that description: it requires an attacker who is already locally present on the managed endpoint with low privileges and yields full confidentiality, integrity, and availability compromise - i.e. escalation to SYSTEM/root-level control of the host. The exploitation signals are notably quiet and mutually consistent: EPSS is 0.01% (1st percentile), there is no CISA KEV listing, and no public exploit code is referenced, so there is no public exploit identified at time of analysis. The low EPSS aligns with the local attack vector - this is not a remotely-wormable or mass-exploitable issue and will not show up in internet-wide scanning, which deflates probabilistic exploitation models. Net assessment: this is a genuine post-compromise/local-attacker priority (an endpoint-management agent running with high privilege is a high-value escalation target and a potential lateral-movement/tenant-wide pivot), but it is NOT a drop-everything remote emergency. No conflicting signals were found between the CVSS vector and the description; both point to local privilege escalation. Key missing data: the vendor advisory content was not retrieved, so the exact fixed build and the precise misconfiguration are not independently confirmed here.

A low-privileged local user (or malware already running in a standard user context) on a Windows endpoint managed by the Endpoint Central agent abuses the improper privilege management in the agent setup to execute code or manipulate files in the agent's high-privilege context. This results in escalation to SYSTEM-level control of the endpoint. No public proof-of-concept is referenced, and exploitation requires existing local access rather than a network-facing entry point.