CVE-2019-17602

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 81.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-10-15 · updated 2026-06-17
Weakness: CWE-89

Description

An issue was discovered in Zoho ManageEngine OpManager before 12.4 build 124089. The OPMDeviceDetailsServlet servlet is prone to SQL injection. Depending on the configuration, this vulnerability could be exploited unauthenticated or authenticated.

Affected products

Zohocorp ManageEngine OpManager: before 12.4; 12.4, 12.4-build124000, 12.4-build124011, 12.4-build124012, 12.4-build124013, 12.4-build124014 (+34) — fixed in 12.4

How to fix

Upgrade to a fixed version: Zohocorp ManageEngine OpManager 12.4. Check the vendor advisory for mitigations.

References

https://www.manageengine.com/network-monitoring/help/read-me-complete.html
https://www.manageengine.com/network-monitoring/help/read-me-complete.html

Get alerted when CVE-2019-17602 or the next vulnerability affects your stack