CVE-2015-9107 Zoho ManageEngine OpManager 11 through 12.2 uses a custom encryption algorithm to protect the credential used to access the monitored devices. The implemented algorithm doesn't use a per-system key or...
CriticalCVSS 9.8
EPSS 4.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Zoho ManageEngine OpManager 11 through 12.2 uses a custom encryption algorithm to protect the credential used to access the monitored devices. The implemented algorithm doesn't use a per-system key or even a salt; therefore, it's possible to create a universal decryptor.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Zohocorp ManageEngine OpManager | = 11.0 | No fix listed |
| Zohocorp ManageEngine OpManager | = 11.1 | No fix listed |
| Zohocorp ManageEngine OpManager | = 11.2 | No fix listed |
| Zohocorp ManageEngine OpManager | = 11.3 | No fix listed |
| Zohocorp ManageEngine OpManager | = 11.4 | No fix listed |
| Zohocorp ManageEngine OpManager | = 11.5 | No fix listed |
| Zohocorp ManageEngine OpManager | = 11.6 | No fix listed |
| Zohocorp ManageEngine OpManager | = 12.2 | No fix listed |
References
- github.com third-party-advisory