Manageengine Firewall Analyzer
Monthly
Command injection in the Diagnose Settings feature of ZohoCorp ManageEngine OpManager and Firewall Analyzer 12.8.709 and earlier allows an authenticated low-privilege user to run arbitrary operating system commands on the host through the web management interface, resulting in complete loss of confidentiality, integrity, and availability (CVSS 8.8, PR:L, UI:N). Exploitation requires a valid low-privileged account and network reachability to the console, but no user interaction and no non-default configuration, so the management interface is the primary gating factor. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, meaning the practical risk is concentrated on internet- or partner-facing ManageEngine consoles where any account holder can reach the vulnerable feature.
An authenticated, low-privileged user of ManageEngine OpManager or ManageEngine Firewall Analyzer (versions 12.8.709 and below) can abuse the 'Rule Tracking Compare Policies' feature to inject crafted XML that is parsed server-side, disclosing data beyond that feature's authorization boundary. The vendor-assigned CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, base 7.7) reflects a network-reachable, low-complexity issue requiring only any valid console credential and no user interaction, with a scope change and high confidentiality impact but no integrity or availability impact, which confines the practical effect to information disclosure rather than code execution or service disruption. Because a session is required, the flaw is not pre-authentication exploitable; no public exploit code has been identified at time of analysis and no KEV listing was provided in the available intelligence, so exploitation appears to depend on an attacker first obtaining or holding a low-privilege console account with access to the affected feature.
Data exposure in ManageEngine Firewall Analyzer - and in the co-listed ManageEngine OpManager - version 12.8.709 and below allows an unauthenticated attacker positioned on the same network segment as the Firewall Analyzer syslog collector to read sensitive information, including data belonging to the monitored firewall and network devices, which is why the vendor score carries a scope change despite the confidentiality-only impact. No authentication or user interaction is required and complexity is low (CVSS 3.1 7.4, AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N); the adjacent-network requirement is the principal limiting factor, since the collector is not reachable directly from the internet unless its syslog service has been exposed beyond the local segment. There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV) in the supplied intelligence, which consists solely of a vendor advisory and CPE mappings, and no EPSS score was provided.
Privilege escalation in Zoho ManageEngine OpManager and Firewall Analyzer 12.8.710 and earlier allows an authenticated low-privilege user to gain Administrator privileges by importing a crafted Report Profile. The issue is network-reachable with low attack complexity and requires no user interaction (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, base 8.1 High), but the attacker must already hold working low-privilege credentials on the target instance and no non-default configuration is needed. No public exploit identified at time of analysis.
Broken access control in ZohoCorp ManageEngine OpManager and ManageEngine Firewall Analyzer 12.8.710 and earlier lets an authenticated low-privilege console user create alert notifications for firewalls that fall outside their assigned scope. The weakness (CWE-639, authorization bypass through a user-controlled key) only matters in deployments that actually enforce separate scopes - multi-user, multi-team, or multi-tenant setups - since a flat single-administrator installation has no boundary to cross. Exploitation requires a valid, even minimal, console account (CVSS vector PR:L, no user interaction) and there is no public exploit identified at time of analysis: no CISA KEV listing, no EPSS score, and no POC were provided.
Broken access control in ZohoCorp ManageEngine OpManager and Firewall Analyzer 12.8.710 and below allows an authenticated low-privilege user to modify Change Management report schedule configurations for firewalls outside their assigned scope. The vendor CVSS 3.1 vector is 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N), but independent assessment adjusts confidentiality to Low (C:L/I:L), because impact is limited to cross-scope report scheduling data and requires a pre-existing low-privilege account plus a multi-scope/RBAC deployment. No public exploit or CISA KEV listing was identified at time of analysis.
SQL injection in the Rule Management Search Reports feature of ManageEngine OpManager and Firewall Analyzer 12.8.669 and earlier allows a remote, authenticated low-privilege user to inject arbitrary SQL through a search parameter, giving them database read and write capability with high confidentiality, integrity, and availability impact (CVSS 3.1: 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw is rated CVSS 8.8 and affects on-premises ITOM deployments exposing the web console; exploitation requires prior possession of valid credentials at any privilege tier, so it is not a pre-authentication flaw. At time of analysis there is no public exploit identified and no confirmed active exploitation, but the vendor has released a patch in version 12.8.670, making upgrade the decisive remediation step.
A directory traversal vulnerability exists in the uploadMib functionality of ManageEngine OpManager 12.7.258. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 81.6%.
An information disclosure vulnerability exists in multiple ManageEngine products that can result in encryption keys being exposed. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, and OpUtils before 2022-07-29 through 2022-07-30 ( 125658, 126003, 126105, and 126120). Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, Firewall Analyzer, and OpUtils before 2022-07-27 through 2022-07-28 (125657, 126002,. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
ManageEngine Password Manager Pro 12100 and prior and OPManager 126100 and prior are vulnerable to unauthorized file and directory creation on a server machine. Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Incorrect file permissions on the packaged Nipper executable file in Zoho ManageEngine OpManager 12.4.072 and Firewall Analyzer 12.4.072 allow local users to elevate privileges to root by overwriting. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available.
The "default reports" feature in Zoho ManageEngine Firewall Analyzer before 12.3 Build 123218 is vulnerable to SQL Injection. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Custom Report import function in Zoho ManageEngine Firewall Analyzer before 12.3 Build 123224 is vulnerable to XML External Entity (XXE) Injection. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The user defined DNS name in Zoho ManageEngine Firewall Analyzer before 12.3 Build 123224 is vulnerable to stored XSS attacks. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Zoho ManageEngine Firewall Analyzer 12200 has an unrestricted File Upload vulnerability in the "Group Chat" section. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
ManageEngine Firewall Analyzer before 8.0 does not restrict access permissions. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Directory traversal vulnerability in ManageEngine Firewall Analyzer before 8.0. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 36.2%.
Command injection in the Diagnose Settings feature of ZohoCorp ManageEngine OpManager and Firewall Analyzer 12.8.709 and earlier allows an authenticated low-privilege user to run arbitrary operating system commands on the host through the web management interface, resulting in complete loss of confidentiality, integrity, and availability (CVSS 8.8, PR:L, UI:N). Exploitation requires a valid low-privileged account and network reachability to the console, but no user interaction and no non-default configuration, so the management interface is the primary gating factor. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, meaning the practical risk is concentrated on internet- or partner-facing ManageEngine consoles where any account holder can reach the vulnerable feature.
An authenticated, low-privileged user of ManageEngine OpManager or ManageEngine Firewall Analyzer (versions 12.8.709 and below) can abuse the 'Rule Tracking Compare Policies' feature to inject crafted XML that is parsed server-side, disclosing data beyond that feature's authorization boundary. The vendor-assigned CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, base 7.7) reflects a network-reachable, low-complexity issue requiring only any valid console credential and no user interaction, with a scope change and high confidentiality impact but no integrity or availability impact, which confines the practical effect to information disclosure rather than code execution or service disruption. Because a session is required, the flaw is not pre-authentication exploitable; no public exploit code has been identified at time of analysis and no KEV listing was provided in the available intelligence, so exploitation appears to depend on an attacker first obtaining or holding a low-privilege console account with access to the affected feature.
Data exposure in ManageEngine Firewall Analyzer - and in the co-listed ManageEngine OpManager - version 12.8.709 and below allows an unauthenticated attacker positioned on the same network segment as the Firewall Analyzer syslog collector to read sensitive information, including data belonging to the monitored firewall and network devices, which is why the vendor score carries a scope change despite the confidentiality-only impact. No authentication or user interaction is required and complexity is low (CVSS 3.1 7.4, AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N); the adjacent-network requirement is the principal limiting factor, since the collector is not reachable directly from the internet unless its syslog service has been exposed beyond the local segment. There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV) in the supplied intelligence, which consists solely of a vendor advisory and CPE mappings, and no EPSS score was provided.
Privilege escalation in Zoho ManageEngine OpManager and Firewall Analyzer 12.8.710 and earlier allows an authenticated low-privilege user to gain Administrator privileges by importing a crafted Report Profile. The issue is network-reachable with low attack complexity and requires no user interaction (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, base 8.1 High), but the attacker must already hold working low-privilege credentials on the target instance and no non-default configuration is needed. No public exploit identified at time of analysis.
Broken access control in ZohoCorp ManageEngine OpManager and ManageEngine Firewall Analyzer 12.8.710 and earlier lets an authenticated low-privilege console user create alert notifications for firewalls that fall outside their assigned scope. The weakness (CWE-639, authorization bypass through a user-controlled key) only matters in deployments that actually enforce separate scopes - multi-user, multi-team, or multi-tenant setups - since a flat single-administrator installation has no boundary to cross. Exploitation requires a valid, even minimal, console account (CVSS vector PR:L, no user interaction) and there is no public exploit identified at time of analysis: no CISA KEV listing, no EPSS score, and no POC were provided.
Broken access control in ZohoCorp ManageEngine OpManager and Firewall Analyzer 12.8.710 and below allows an authenticated low-privilege user to modify Change Management report schedule configurations for firewalls outside their assigned scope. The vendor CVSS 3.1 vector is 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N), but independent assessment adjusts confidentiality to Low (C:L/I:L), because impact is limited to cross-scope report scheduling data and requires a pre-existing low-privilege account plus a multi-scope/RBAC deployment. No public exploit or CISA KEV listing was identified at time of analysis.
SQL injection in the Rule Management Search Reports feature of ManageEngine OpManager and Firewall Analyzer 12.8.669 and earlier allows a remote, authenticated low-privilege user to inject arbitrary SQL through a search parameter, giving them database read and write capability with high confidentiality, integrity, and availability impact (CVSS 3.1: 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw is rated CVSS 8.8 and affects on-premises ITOM deployments exposing the web console; exploitation requires prior possession of valid credentials at any privilege tier, so it is not a pre-authentication flaw. At time of analysis there is no public exploit identified and no confirmed active exploitation, but the vendor has released a patch in version 12.8.670, making upgrade the decisive remediation step.
A directory traversal vulnerability exists in the uploadMib functionality of ManageEngine OpManager 12.7.258. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 81.6%.
An information disclosure vulnerability exists in multiple ManageEngine products that can result in encryption keys being exposed. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, and OpUtils before 2022-07-29 through 2022-07-30 ( 125658, 126003, 126105, and 126120). Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, Firewall Analyzer, and OpUtils before 2022-07-27 through 2022-07-28 (125657, 126002,. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
ManageEngine Password Manager Pro 12100 and prior and OPManager 126100 and prior are vulnerable to unauthorized file and directory creation on a server machine. Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Incorrect file permissions on the packaged Nipper executable file in Zoho ManageEngine OpManager 12.4.072 and Firewall Analyzer 12.4.072 allow local users to elevate privileges to root by overwriting. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available.
The "default reports" feature in Zoho ManageEngine Firewall Analyzer before 12.3 Build 123218 is vulnerable to SQL Injection. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Custom Report import function in Zoho ManageEngine Firewall Analyzer before 12.3 Build 123224 is vulnerable to XML External Entity (XXE) Injection. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The user defined DNS name in Zoho ManageEngine Firewall Analyzer before 12.3 Build 123224 is vulnerable to stored XSS attacks. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Zoho ManageEngine Firewall Analyzer 12200 has an unrestricted File Upload vulnerability in the "Group Chat" section. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
ManageEngine Firewall Analyzer before 8.0 does not restrict access permissions. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Directory traversal vulnerability in ManageEngine Firewall Analyzer before 8.0. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 36.2%.