CVE-2022-38772

Deeper analysis

Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, and OpUtils versions prior to 125658, 126003, 126105, and 126120 contain a vulnerability that permits authenticated users to alter database entries, resulting in remote code execution through the NMAP feature. The issue carries a CVSS 3.1 score of 8.8 and affects multiple ManageEngine IT operations management products that share the same underlying code base.

An attacker with valid low-privileged credentials can exploit the flaw over the network without user interaction to modify database records and trigger arbitrary code execution, achieving full compromise of confidentiality, integrity, and availability on the affected server.

Vendor advisories published at manageengine.com and https://www.manageengine.com/itom/advisory/cve-2022-38772.html direct customers to apply the listed fixed builds to eliminate the database modification path that leads to NMAP-based code execution.

The associated EPSS score has remained flat at its peak value of 0.3914 since disclosure, indicating no material increase in observed exploitation interest.