CVE-2019-12133

HIGH

Multiple Zoho ManageEngine products - Privilege Escalation

Title source: llm

Description

Multiple Zoho ManageEngine products suffer from local privilege escalation due to improper permissions for the %SYSTEMDRIVE%\ManageEngine directory and its sub-folders. Moreover, the services associated with said products try to execute binaries such as sc.exe from the current directory upon system start. This will effectively allow non-privileged users to escalate privileges to NT AUTHORITY\SYSTEM. This affects Desktop Central 10.0.380, EventLog Analyzer 12.0.2, ServiceDesk Plus 10.0.0, SupportCenter Plus 8.1, O365 Manager Plus 4.0, Mobile Device Manager Plus 9.0.0, Patch Connect Plus 9.0.0, Vulnerability Manager Plus 9.0.0, Patch Manager Plus 9.0.0, OpManager 12.3, NetFlow Analyzer 11.0, OpUtils 11.0, Network Configuration Manager 11.0, FireWall 12.0, Key Manager Plus 5.6, Password Manager Pro 9.9, Analytics Plus 1.0, and Browser Security Plus.

References (2)

Scores

CVSS v3 7.8
EPSS 0.0002
EPSS Percentile 4.1%
Attack Vector LOCAL
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Classification

CWE
CWE-427 CWE-732
Status published

Affected Products (18)

zohocorp/manageengine_analytics_plus
zohocorp/manageengine_browser_security_plus
zohocorp/manageengine_desktop_central
zohocorp/manageengine_eventlog_analyzer
zohocorp/manageengine_firewall
zohocorp/manageengine_key_manager_plus
zohocorp/manageengine_mobile_device_manager_plus
zohocorp/manageengine_netflow_analyzer
zohocorp/manageengine_network_configuration_manager
zohocorp/manageengine_o365_manager_plus
zohocorp/manageengine_opmanager
zohocorp/manageengine_oputils
zohocorp/manageengine_password_manager_pro
zohocorp/manageengine_patch_connect_plus
zohocorp/manageengine_patch_manager_plus
... and 3 more

Timeline

Published Jun 18, 2019
Tracked Since Feb 18, 2026