CVE-2022-37024
Zohocorp Manageengine Firewall Analyzer 12.5 … 12.6
Raw vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2022-37024 is a high-severity an unspecified weakness vulnerability in Zohocorp Manageengine Firewall Analyzer. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 0.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, and OpUtils before the builds released 2022-07-29 through 2022-07-30 are affected by a vulnerability that permits authenticated users to perform database changes resulting in remote code execution. The flaw carries a CVSS 3.1 base score of 8.8.
An attacker who already possesses valid credentials on an affected installation can exploit the issue to modify database contents and ultimately achieve remote code execution on the server.
The vendor advisory at https://www.manageengine.com/itom/advisory/cve-2022-37024.html addresses the affected builds and outlines available patches. The associated EPSS score has remained at a peak and current value of 0.5123 with no material rise observed after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-39678
Vulnerability Data
Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, and OpUtils before 2022-07-29 through 2022-07-30 ( 125658, 126003, 126105, and 126120) allow authenticated users to make database changes that lead to remote code execution.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.