Zoho ManageEngine Password Manager Pro before 12101 and PAM360 before 5510 are vulnerable to unauthenticated remote code execution.
Affects Zoho ManageEngine Password Manager Pro 12100 and below and PAM360 5500 and below in the unauthenticated case. CVSS scores it 9.8 (critical); no vendor rating is given. Fixed builds are 12101 and 5510.
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Actively exploited
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Zoho ManageEngine Password Manager Pro and PAM360, along with ManageEngine Access Manager Plus (the latter requiring authentication), are affected. An attacker could exploit these flaws to run malicious code on the affected server without needing to log in, potentially gaining full control over the system.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Zoho ManageEngine Password Manager Pro before 12101 and PAM360 before 5510 are vulnerable to unauthenticated remote code execution. (This also affects ManageEngine Access Manager Plus before 4303 with authentication.)
Timeline
- CVE published
- Added to CISA KEV
CISA has evidence of exploitation in the wild
- CISA remediation deadline
Due date for US federal agencies to patch
- Record last updated
- EPSS reached 10%
FIRST estimates at least a 10% chance of exploitation in the next 30 days
Affected versions
- n/a n/a
Version range not reported
References 2
manageengine.com
packetstormsecurity.com
Questions about CVE-2022-35405
What does this mean?
Remote attackers could execute arbitrary code on affected installations of Password Manager Pro, PAM360 and Access Manager Plus. The unauthenticated case means no login is needed for the attack to reach the product.Source: manageengine.com
Am I affected, and how do I check?
Password Manager Pro 12100 and below and PAM360 5500 and below are affected in the unauthenticated case. Compare the installed build number of the product with these versions to check the installed version.Source: manageengine.com
What should I do about it?
Upgrade Password Manager Pro to build 12101 or later, or PAM360 to build 5510 or later.Source: manageengine.com
Is it being exploited?
Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2022-09-22, which means it has evidence of attacks. No public exploit code is tracked.Source: cisa.gov, cve.now feed data
What if there's no patch?
The checked facts do not list a workaround. Until a fixed build is installed, no mitigation is supported by the facts provided.Source: manageengine.com