CVEvulnerability
CVE-2019-17421
7.8 HIGH
Official page ↗
- Status
- Modified
- Published
- 2019-11-21
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 7.8 HIGH — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 7.2 HIGH — AV:L/AC:L/Au:N/C:C/I:C/A:C
- Weaknesses
- CWE-276
Description
Incorrect file permissions on the packaged Nipper executable file in Zoho ManageEngine OpManager 12.4.072 and Firewall Analyzer 12.4.072 allow local users to elevate privileges to root by overwriting this file with a malicious payload.
Affected configurations
• zohocorp manageengine firewall analyzer 12.4
• zohocorp manageengine opmanager 12.4
Related
Weakness · CWE (1)
- CWE-276 Incorrect Default Permissions weakness
References
- https://blog.vastart.dev/2019/11/cve-2019-17421-privilege-escalation.html Third Party Advisory
- https://twitter.com/va_start Exploit, Third Party Advisory
- https://www.manageengine.com/products/firewall/security-updates/cve-2019-17421.html Patch, Vendor Advisory
- https://blog.vastart.dev/2019/11/cve-2019-17421-privilege-escalation.html Third Party Advisory
- https://twitter.com/va_start Exploit, Third Party Advisory
- https://www.manageengine.com/products/firewall/security-updates/cve-2019-17421.html Patch, Vendor Advisory