CVE-2015-9107: Critical severity manageengine opmanager msp vulnerability
Zoho ManageEngine OpManager 11 through 12.2 uses a custom encryption algorithm to protect the credential used to access the monitored devices. The implemented algorithm doesn't use a per-system key or even a salt; therefore, it's possible to create a universal decryptor.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2015-9107?
CVE-2015-9107 is a vulnerability in Zoho ManageEngine OpManager versions 11.0 to 12.2 that uses a custom encryption algorithm without a per-system key or salt, allowing the creation of a universal decryptor for credentials.
What is the severity of CVE-2015-9107?
The severity of CVE-2015-9107 is classified as critical because it allows unauthorized access to sensitive credentials.
How do I fix CVE-2015-9107?
To fix CVE-2015-9107, it is recommended to upgrade to a later version of Zoho ManageEngine OpManager that addresses this vulnerability.
Which versions of OpManager are affected by CVE-2015-9107?
CVE-2015-9107 affects ManageEngine OpManager versions from 11.0 to 12.2.
What should I do if I cannot upgrade due to CVE-2015-9107?
If you cannot upgrade due to CVE-2015-9107, consider implementing additional security measures such as restricting access and monitoring for suspicious activity.