PT-2022-28076 · Zoho · Zoho Manageengine Device Control Plus

Published 2022-12-20 · Updated 2024-08-03 · CVE-2022-47578

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Device Control Plus version 10.1.2228.15

Description An issue was discovered in the endpoint protection agent, where configuring complete restrictions on USB devices does not prevent bypassing these restrictions by booting into Safe Mode. This allows a file to be exchanged outside the system and potentially introduces malware. Data exfiltration can occur. The vendor disputes this as a vulnerability in their product.

Recommendations For Zoho ManageEngine Device Control Plus version 10.1.2228.15, consider restricting access to Safe Mode to prevent bypassing USB restrictions, as a temporary workaround until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Authentication Bypass Using an Alternate Path or Channel

Weakness Enumeration

CWE-288

Related Identifiers

CVE-2022-47578

Affected Products

Zoho Manageengine Device Control Plus

References · 9

• 🔥 https://medium.com/nestedif/vulnerability-disclosure-business-logic-unauthorized-data-exfiltration-bypassing-dlp-zoho-cc51465ba84a · Exploit
• https://manageengine.com/device-control/how-to/device-control.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-47578 · Security Note
• https://osv.dev/vulnerability/CVE-2022-47578 · Vendor Advisory
• https://t.me/cvenotify/40963 · Telegram Post
• https://t.me/cvenotify/88787 · Telegram Post
• https://t.me/cvenotify/40802 · Telegram Post
• https://t.me/cibsecurity/54950 · Telegram Post
• https://t.me/cvenotify/87079 · Telegram Post