ManageEngine EndPoint Central CVE-2025-7473

Exploitation requires an attacker to already hold low-privileged authenticated access (PR:L) and local access to the system (AV:L), then supply malicious input to a feature of ManageEngine EndPoint Central that parses XML data (per the vendor's 'parsing-xml-data' reference). No user interaction is needed (UI:N). Limiting factors that reduce real-world risk: the attacker must first authenticate with valid credentials, the vector is local rather than network-facing per the vendor CVSS, and impact is bounded to LOW for confidentiality, integrity, and availability. The one-line description does not name the exact vulnerable feature or input field, so the precise configuration or module exposing the XML parser should be confirmed with Zoho.

This is a moderate-severity, low-priority issue despite being a flaw in enterprise software. The vendor CVSS vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L, base 5.3) indicates LOCAL attack vector with LOW privileges already required and only LOW impact across confidentiality, integrity, and availability - meaning an attacker must already have authenticated low-level access to the system before exploiting it. The EPSS score of 0.34% (25th percentile) reinforces low real-world exploitation likelihood. There is no CISA KEV listing and no public proof-of-concept identified. No SSVC decision data was provided in the input. The signals are internally consistent: low CVSS, low EPSS, no KEV, no POC all point the same direction - this is a genuinely low-urgency finding, not a high-CVSS-but-overrated one. NOTE A DISCREPANCY TO VERIFY: XML injection flaws in a web-based management console like EndPoint Central would typically carry a NETWORK vector (AV:N), yet the vendor assigned AV:L (local). The sparse one-line description does not explain this, so the exact attack surface (local-only vs. remotely reachable console input) should be confirmed with Zoho before finalizing prioritization.

An attacker with existing low-privileged authenticated access to a ManageEngine EndPoint Central instance submits crafted input into an XML-parsing feature, injecting malicious XML content that the parser processes. This allows limited unauthorized reading or modification of data handled by the XML processor. No public exploit code is available, and the local attack vector means the attacker must already have a foothold on or authenticated access to the host.