dbcve.org
Manageengine Firewall AnalyzerApplication · Zohocorp

CVE-2022-37024

HIGH · 8.8 CVSS v3.1 Published 2022-08-10
Mitigation only
No fix yet — a mitigation exists. There is no fixed release. A documented workaround reduces exposure in the meantime.
See remediation →
94/100
Remediation priority · Urgent
High EPSS Remotely reachable Zero-click

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, and OpUtils before 2022-07-29 through 2022-07-30 ( 125658, 126003, 126105, and 126120) allow authenticated users to make database changes that lead to remote code execution.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · high confidence

This vulnerability in multiple Zoho ManageEngine products (OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, and OpUtils) allows authenticated users to make database changes that result in remote code execution. The issue was addressed in patches released around July 29-30, 2022 referencing CVEs 125658, 126003, 126105, and 126120.

MitigationApply the security patches released on 2022-07-29 or 2022-07-30 for the affected ManageEngine products. Ensure the patches are applied to all instances of OpManager, Network Configuration Manager, NetFlow Analyzer, and OpUtils. Consider restricting administrative access to trusted personnel only until patches are applied.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.

NVD · CPE data
Manageengine Firewall AnalyzerApplication
Affected:= 12.5= 12.6
Manageengine Netflow AnalyzerApplication
Affected:= 12.5= 12.6
Manageengine Network Configuration ManagerApplication
Affected:= 12.5= 12.6
Manageengine OpmanagerApplication
Affected:= 12.5= 12.6
Manageengine Opmanager MspApplication
Affected:= 12.5= 12.6
Manageengine Opmanager PlusApplication
Affected:= 12.5= 12.6
Manageengine OputilsApplication
Affected:= 12.5= 12.6

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Identify installed ManageEngine product
    Locate the product name in the application's web interface (typically in the header or About section), or check the installation directory for product-specific folder names such as OpManager, NetFlow Analyzer, NetworkConfigurationManager, OpUtils, or FirewallAnalyzer
    Affected if The installed product is one of: OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, Firewall Analyzer, or OpUtils
  2. Determine product version number
    Access the product's web console and navigate to the About or Help section to view the exact version number (for example, the version is typically displayed as '12.5' or '12.6' in the product information page)
    Affected if The installed version is exactly 12.5 or exactly 12.6 (these are the vulnerable versions per the CVE)
  3. Check patch application date
    Locate the patch information in the product's release notes, update history, or system information page - patches for this CVE were released around July 29-30, 2022 with internal references CVEs 125658, 126003, 126105, and 126120
    Affected if The product has not been updated with patches released on or after July 29-2022, or no patch referencing those CVE numbers has been applied
  4. Verify authenticated access availability
    Determine if the product's web interface is accessible and whether user accounts with database modification privileges exist (the vulnerability requires an authenticated user to make database changes leading to RCE)
    Affected if The product web interface is exposed and user accounts with elevated privileges are present without confirmed patch application

The environment is affected if any of the listed ManageEngine products is installed with version 12.5 or 12.6 and has not received the security patches released around July 29-30, 2022.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

dbcve · scoped
Mitigation available No clean upgrade yet — mitigate in the meantime
Mitigation

Apply the security patches released on 2022-07-29 or 2022-07-30 for the affected ManageEngine products. Ensure the patches are applied to all instances of OpManager, Network Configuration Manager, NetFlow Analyzer, and OpUtils. Consider restricting administrative access to trusted personnel only until patches are applied.

Recommended fix Moderate confidence

Version 12.7 or later (first fixed release)

  1. 1. Identify the specific ManageEngine product (OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, Firewall Analyzer, or OpUtils) running in your environment
  2. 2. Check the current installed version of the affected product
  3. 3. Download the latest version from the official ManageEngine download portal or contact ManageEngine support
  4. 4. Review the upgrade documentation for your specific product before proceeding
  5. 5. Perform a backup of current configurations and data
  6. 6. Schedule a maintenance window for the upgrade
  7. 7. Install version 12.7 or later (the first version containing the fix for this vulnerability)
  8. 8. After upgrade, verify the application starts successfully and all services are running
Caveat Review product-specific release notes for potential configuration changes or feature modifications between versions 12.5/12.6 and 12.7+

Generated from the published advisory — verify against the referenced sources before acting.

Fix this in Manageengine Firewall Analyzer Scoped from the published advisory
  • Consultation2.0 h
  • Implementation4.0 h
  • Testing3.0 h
  • Review / QA2.0 h
11.0 hours of engineering $1,930
Get help mitigating

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $3,088.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2022-37024 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2022-37024 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data