CVE-2025-3444: Local File Inclusion
Published May 22, 2025
·Updated
Zohocorp ManageEngine ServiceDesk Plus MSP and SupportCenter Plus versions below 14920 are vulnerable to authenticated Local File Inclusion (LFI) in the Admin module, where help card content is loaded.
Affected Software
8 affected components
ZohoCorp ManageEngine ServiceDesk Plus MSP<14920
Zohocorp SupportCenter Plus<14920
ZohoCorp ManageEngine ServiceDesk Plus MSP<=14.8
ZohoCorp ManageEngine ServiceDesk Plus MSP=14.9-14900
ZohoCorp ManageEngine ServiceDesk Plus MSP=14.9-14910
Zohocorp Manageengine Supportcenter Plus<=14.8
Zohocorp Manageengine Supportcenter Plus=14.9-14900
Zohocorp Manageengine Supportcenter Plus=14.9-14910
Event History
May 22, 2025
CVE Published
via MITRE·10:31 AM
Data Sourced
via MITRE·10:31 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·11:15 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2025-3444?
CVE-2025-3444 has a high severity rating due to the potential for local file inclusion attacks.
2
How do I fix CVE-2025-3444?
To fix CVE-2025-3444, upgrade ManageEngine ServiceDesk Plus MSP and SupportCenter Plus to version 14920 or later.
3
What systems are affected by CVE-2025-3444?
CVE-2025-3444 affects ManageEngine ServiceDesk Plus MSP and SupportCenter Plus versions below 14920.
4
What type of attack is possible with CVE-2025-3444?
CVE-2025-3444 allows for authenticated local file inclusion attacks in the Admin module.
5
What should I do if I cannot upgrade to fix CVE-2025-3444?
If you cannot upgrade, implement strict access controls and monitor logs to mitigate the risk associated with CVE-2025-3444.