CVE-2015-9107

Zoho ManageEngine OpManager 11 through 12.2 uses a custom encryption algorithm to protect the credential used to access the monitored devices. The implemented algorithm doesn't use a per-system key or even a salt; therefore, it's possible to create a universal decryptor.

Score

CVSS 3.0 9.8 Critical

Status

Modified - cve@mitre.org

Published

2017-08-04

Last modified

2024-08-06

Weaknesses

CWE-310

Affected products

• Manageengine Opmanager (Zohocorp)

References

• https://github.com/theguly/DecryptOpManager