Login Request a demo
Critical severity · published Aug 16, 2019
CVE-2019-15106
An issue was discovered in Zoho ManageEngine OpManager in builds before 14310
9.8
CVSS
25.5%
EPSS
No
On KEV
Description
An issue was discovered in Zoho ManageEngine OpManager in builds before 14310. One can bypass the user password requirement and execute commands on the server. The "username+'@opm' string is used for the password. For example, if the username is admin, the password is admin@opm.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)25.5% · higher than 98% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MO
Manageengine Opmanager · Zohocorp
through 12.4.034 · source: NVD
Affected product
MO
Manageengine Opmanager
Zohocorp
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-15106
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-15106
Exploit
http://pentest.com.tr/exploits/DEFCON-ManageEngine-OpManager-v12-4-Unauthenticated-Remote-Command-Execution.html
Exploit
https://www.exploit-db.com/exploits/47229
www.manageengine.com
https://www.manageengine.com/network-monitoring/security-updates/cve-2019-15106.html
www.manageengine.com
https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2019-15106.html
More from Manageengine Opmanager
9.9
CVE-2026-19599
Remote Code Execution vulnerability
9.8
CVE-2022-29535
Zoho ManageEngine OPManager through 125588 allows SQL Injection via a few default reports
9.8
CVE-2021-44514
OpUtils in Zoho ManageEngine OpManager 12.5 before 125490 mishandles authentication for a few audit directories
9.8
CVE-2021-41075
The NetFlow Analyzer in Zoho ManageEngine OpManger before 125455 is vulnerable to SQL Injection in the Attacks Module API
9.8
CVE-2021-40493
Zoho ManageEngine OpManager before 125437 is vulnerable to SQL Injection in the support diagnostics module