What’s Vulnerable › Vulnerabilities

CVE-2019-17421

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2019-11-21 · updated 2026-06-17
• Weakness: CWE-276

Description

Incorrect file permissions on the packaged Nipper executable file in Zoho ManageEngine OpManager 12.4.072 and Firewall Analyzer 12.4.072 allow local users to elevate privileges to root by overwriting this file with a malicious payload.

Affected products

• Zohocorp ManageEngine Firewall Analyzer: 12.4-124072
• Zohocorp ManageEngine OpManager: 12.4-build124072

References

• https://blog.vastart.dev/2019/11/cve-2019-17421-privilege-escalation.html
• https://twitter.com/va_start
• https://www.manageengine.com/products/firewall/security-updates/cve-2019-17421.html
• https://blog.vastart.dev/2019/11/cve-2019-17421-privilege-escalation.html
• https://twitter.com/va_start
• https://www.manageengine.com/products/firewall/security-updates/cve-2019-17421.html

Get alerted when CVE-2019-17421 or the next vulnerability affects your stack