CVE-2022-35405criticalunder attackCWE-502

CVE-2022-35405

Published · Updated

Follow this CVE+ Monitor ManageEngine ServiceDesk

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 9.8epss 100%
from disclosure to weaponsame day
Published on NVDJul 19
1st PoCJul 18
metasploitJun 24
CISA KEV+65d
Action required by CISAfederal deadline: 2022-10-13

Apply updates per vendor instructions.

In short

Zoho ManageEngine Password Manager Pro and PAM360 allow attackers to run malicious code on the server without needing to log in. This is critical because these tools protect sensitive passwords and access credentials, so compromising them puts all protected accounts at risk.

Technical detail

CWE-502 deserialization vulnerability enables unauthenticated remote code execution in Password Manager Pro (<12101) and PAM360 (<5510) through untrusted object deserialization. Attack vector is network-based with no authentication required; exploitation results in complete server compromise with root privileges.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Zoho ManageEngine Password Manager Pro before 12101 and PAM360 before 5510 are vulnerable to unauthenticated remote code execution. (This also affects ManageEngine Access Manager Plus before 4303 with authentication.)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · n/a
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.