High severity · published Aug 23, 2024
CVE-2024-5466
Zohocorp ManageEngine OpManager and Remote Monitoring and Management versions 128329 and below are vulnerable to the authenticated remote code execution in the deploy agent option
8.8
CVSS
6.9%
EPSS
No
On KEV
Description
Zohocorp ManageEngine OpManager and Remote Monitoring and Management versions 128329 and below are vulnerable to the authenticated remote code execution in the deploy agent option.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)6.9% · higher than 94% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MO
Manageengine Opmanager · Zohocorp
through 12.7; 12.8; 12.8; 12.8; 12.8; 12.8 · source: NVD
MO
Manageengine Opmanager Msp · Zohocorp
through 12.7; 12.8; 12.8; 12.8; 12.8; 12.8 · source: NVD
MO
Manageengine Opmanager Plus · Zohocorp
through 12.7; 12.8; 12.8; 12.8; 12.8; 12.8 · source: NVD
MR
Manageengine Remote Monitoring And Management Central · Zohocorp
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-5466
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-5466
Vendor Advisory
https://www.manageengine.com/itom/advisory/cve-2024-5466.html
More from Manageengine Opmanager
9.9
CVE-2026-19599
Remote Code Execution vulnerability
9.8
CVE-2022-29535
Zoho ManageEngine OPManager through 125588 allows SQL Injection via a few default reports
9.8
CVE-2021-44514
OpUtils in Zoho ManageEngine OpManager 12.5 before 125490 mishandles authentication for a few audit directories
9.8
CVE-2021-41075
The NetFlow Analyzer in Zoho ManageEngine OpManger before 125455 is vulnerable to SQL Injection in the Attacks Module API
9.8
CVE-2021-40493
Zoho ManageEngine OpManager before 125437 is vulnerable to SQL Injection in the support diagnostics module