CVE-2024-24409
Zohocorp Manageengine Admanager Plus 6.1 … 7.2
Raw vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2024-24409 is a high-severity Improper Privilege Management (CWE-269) vulnerability in Zohocorp Manageengine Admanager Plus. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-2 (Account Management) and AC-24 (Access Control Decisions) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
Zohocorp ManageEngine ADManager Plus versions 7203 and prior are affected by a privilege escalation vulnerability in the Modify Computers option, assigned CVE-2024-24409 with a CVSS 3.1 base score of 8.8. The flaw is categorized under CWE-269 and permits an authenticated network attacker to elevate privileges without requiring user interaction.
An attacker with low privileges can exploit the issue remotely to obtain full control over confidentiality, integrity, and availability of the affected system. The attack vector is rated as network-accessible with low complexity, allowing any authenticated user to leverage the Modify Computers functionality for unauthorized escalation.
The vendor has published an advisory at https://www.manageengine.com/products/ad-manager/admanager-kb/cve-2024-24409.html that addresses remediation steps for the affected versions. The associated EPSS score reached a peak of 0.0830 after disclosure before settling at the current value of 0.0624.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-21828
Vulnerability Data
Zohocorp ManageEngine ADManager Plus versions 7203 and prior are vulnerable to Privilege Escalation in the Modify Computers option.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Account management directly governs assignment and tracking of privileges so proper implementation stops the weakness from being introduced.
Requiring explicit access-control decisions ensures privileges are evaluated rather than assumed or omitted.
Access enforcement applies the correct privilege checks at every request, structurally preventing unintended spheres of control.
Separation of duties constrains how privileges may be assigned, reducing the chance of overly broad actor control.
Least privilege is the direct countermeasure to improper privilege management; implementing it eliminates the root cause.
Binding security attributes to subjects/objects supplies the mechanism needed to track and enforce privileges correctly.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
A.5.15 directly mandates determining access requirements, defining/enforcing topic-specific access control policy, assigning rights/restrictions by entity/role, consistency with classification, need-to-know, privileged access restrictions, segregation, formal authorization, and dynamic rules — which stops most improper privilege management from being exploitable; bounded remainder is flawed implementation of those rules (e.g. incorrect mapping or enforcement bugs).
A.5.18 directly governs the provisioning, review, modification and timely revocation of access rights (including for role changes, termination and privilege levels), which stops most improper privilege spheres from being exploitable even if the assignment flaw exists; the bounded remainder is flaws in the underlying enforcement mechanism itself (e.g. AC-3/A.8.3)
Defining and communicating authorization levels for each role limits the assignment of excessive or unnecessary privileges.
Logging every use of privileges and protecting those records makes it harder for an attacker who has obtained elevated rights to operate without leaving evidence.
A.8.2 directly controls the identification, allocation, review, expiry, temporary use, and separation of privileged rights per policy, which prevents most improper privilege management (CWE-269) by design; the bounded remainder is flawed tracking/checking logic inside the product's own enforcement code (the AC-3 slice of 269).
A.8.27 mandates security-by-design principles including least privilege, default deny, fail securely, defence in depth, security architecture integration, hardening, and zero-trust verification of every request; these directly stop most improper privilege spheres from being exploitable even if the assignment flaw remains, with a bounded remainder (e.g. certain legacy or safety-overridden controls).
Hardening callouts derived
DISA STIG baselines are authored against specific weaknesses. Where this CVE cites a broad weakness class, the mapping is not asserted at that abstraction (owner ruling, 2026-09-25: grade only at Base and below), so no rule is shown here rather than a rule shown against the wrong grain.