// For flags

CVE-2022-47577

 

Severity Score

7.8
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

1
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Track*
*SSVC
Descriptions

An issue was discovered in the endpoint protection agent in Zoho ManageEngine Device Control Plus 10.1.2228.15. Despite configuring complete restrictions on USB pendrives, USB HDD devices, memory cards, USB connections to mobile devices, etc., it is still possible to bypass the USB restrictions by making use of a virtual machine (VM). This allows a file to be exchanged outside the laptop/system. VMs can be created by any user (even without admin rights). The data exfiltration can occur without any record in the audit trail of Windows events on the host machine. NOTE: the vendor's position is "it's not a vulnerability in our product."

** EN DISPUTA ** Se descubrió un problema en el agente de protección de endpoints en Zoho ManageEngine Device Control Plus 10.1.2228.15. A pesar de configurar restricciones completas en pendrives USB, dispositivos HDD USB, tarjetas de memoria, conexiones USB a dispositivos móviles, etc., todavía es posible saltarse las restricciones USB haciendo uso de una máquina virtual (VM). Esto permite intercambiar un archivo fuera de la computadora portátil/sistema. Cualquier usuario puede crear máquinas virtuales (incluso sin derechos de administrador). La filtración de datos puede ocurrir sin ningún registro en el registro de auditoría de eventos de Windows en la máquina host. NOTA: la posición del proveedor es "no es una vulnerabilidad en nuestro producto".

*Credits: N/A
CVSS Scores
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:Track*
Exploitation
Poc
Automatable
No
Tech. Impact
Partial
* Organization's Worst-case Scenario
Timeline
  • 2022-12-19 CVE Reserved
  • 2022-12-20 CVE Published
  • 2024-07-12 EPSS Updated
  • 2024-08-03 CVE Updated
  • 2024-08-03 First Exploit
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Zohocorp
Search vendor "Zohocorp"
 Manageengine Device Control Plus
Search vendor "Zohocorp" for product "Manageengine Device Control Plus"
 10.1.2228.15
Search vendor "Zohocorp" for product "Manageengine Device Control Plus" and version "10.1.2228.15"
-
Affected