High severity · published Aug 23, 2024
CVE-2024-5466
Remote Code Execution
8.8
CVSS
6.9%
EPSS
No
On KEV
Description
Zohocorp ManageEngine OpManager and Remote Monitoring and Management versions 128329 and below are vulnerable to the authenticated remote code execution in the deploy agent option.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)6.9% · higher than 94% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OR
OpManager, Remote Monitoring and Management · ManageEngine
through 128329 · source: vendor
MO
Manageengine Opmanager · Zohocorp
through 12.7; 12.8; 12.8; 12.8; 12.8; 12.8 · source: NVD, CISA
MO
Manageengine Opmanager Msp · Zohocorp
through 12.7; 12.8; 12.8; 12.8; 12.8; 12.8 · source: NVD, CISA
MO
Manageengine Opmanager Plus · Zohocorp
through 12.7; 12.8; 12.8; 12.8; 12.8; 12.8 · source: NVD, CISA
MR
Manageengine Remote Monitoring And Management Central · Zohocorp
All versions, or not specified · source: NVD
MO
Manageengine Opmanager Rmm · Zohocorp
through 128329 · source: CISA
Affected product
OR
OpManager, Remote Monitoring and Management
ManageEngine