CVE-2021-43319: Zoho ManageEngine Network Configuration Manager before 125488 is vulnerable to command injection due to improper validation in the Ping functionality

Critical severity · published Nov 30, 2021

CVE-2021-43319

Zoho ManageEngine Network Configuration Manager before 125488 is vulnerable to command injection due to improper validation in the Ping functionality

9.8

CVSS

21.4%

EPSS

On KEV

Description

Zoho ManageEngine Network Configuration Manager before 125488 is vulnerable to command injection due to improper validation in the Ping functionality.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

None

Confidentiality

High

Integrity

High

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)21.4% · higher than 98% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Manageengine Network Configuration Manager · Zohocorp

11.0; 11.0; 12.0; 12.0; 12.1; 12.1; +34 more · source: NVD

Affected product

Manageengine Network Configuration Manager

Zohocorp

All Manageengine Network Configuration Manager CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2021-43319

CVE.org

https://www.cve.org/CVERecord?id=CVE-2021-43319

Product

https://manageengine.com

Release Notes

https://www.manageengine.com/network-configuration-manager/release-notes.html#125488

More from Manageengine Network Configuration Manager

9.8

CVE-2021-41081

Zoho ManageEngine Network Configuration Manager before 125465 is vulnerable to SQL Injection in a configuration search

9.8

CVE-2021-41080

Zoho ManageEngine Network Configuration Manager before 125465 is vulnerable to SQL Injection in a hardware details search

8.8

CVE-2023-29505

An issue was discovered in Zoho ManageEngine Network Configuration Manager 12.6.165

8.8

CVE-2022-38772

Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, and OpUtils before 125658, 126003, 126105, and 126120 allow…

8.8

CVE-2022-37024

Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, and OpUtils before 2022-07-29 through 2022-07-30 ( 125658, 126003,…