CVE-2022-35405
Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability
Description
CVE-2022-35405 is a critical remote code execution vulnerability affecting Zoho ManageEngine PAM360, Password Manager Pro, and Access Manager Plus. The vulnerability allows an unauthenticated attacker to execute arbitrary code on the server through an unspecified flaw in the application's request handling. With an EPSS score of 94.31% (99.95th percentile), this vulnerability is nearly certain to be actively exploited. CISA added CVE-2022-35405 to the KEV catalog on September 22, 2022.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| zohocorp | manageengine access manager plus | < 4.3; 4.3 |
| zohocorp | manageengine pam360 | < 5.5; 5.5 |
| zohocorp | manageengine password manager pro | < 12.1; 12.1 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/167918/Zoho-Password-Manager-Pro-XML-RPC-Java-Deserialization.html(Exploit, Third Party Advisory, VDB Entry)
- https://www.manageengine.com/products/passwordmanagerpro/advisory/cve-2022-35405.html(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-35405(US Government Resource)
Weakness Type
CWE-94: Improper Control of Generation of Code ('Code Injection')
CVE-2022-35405 exploits a code injection flaw in Zoho ManageEngine products. The affected applications fail to properly validate and sanitize input in specific request handlers, allowing attackers to inject code that is executed in the context of the application server.
Learn more: CWE-94 — Improper Control of Generation of Code ('Code Injection')
Impact Analysis
CVE-2022-35405 is a critical vulnerability in credential management systems that are designed to protect an organization's most sensitive secrets. The vulnerability allows unauthenticated remote code execution, requiring no authentication, user interaction, or special conditions. Confidentiality is catastrophically impacted as these products store privileged account credentials, SSH keys, certificates, and other secrets for the entire organization. Integrity is compromised as attackers can modify stored credentials and create backdoor accounts. Availability of the credential management infrastructure itself is at risk. The EPSS score of 94.31% confirms near-certain exploitation, and the nature of the affected products (credential vaults) makes this an exceptionally high-impact vulnerability.
Exploit Maturity
CISA confirmed active exploitation of CVE-2022-35405 and added it to the KEV catalog on September 22, 2022, with a remediation deadline of October 13, 2022. The EPSS score of 94.31% (99.95th percentile) indicates near-certain exploitation activity. Public proof-of-concept exploits have been published, and the critical nature of the affected products (privileged access management systems) makes them high-value targets for threat actors seeking access to enterprise credentials. The ransomware association is classified as unknown.
Remediation
- Update ManageEngine products immediately: Upgrade PAM360 to version 5510 or later, Password Manager Pro to version 12101 or later, and Access Manager Plus to version 4303 or later.
- Isolate credential management systems: Ensure ManageEngine credential management products are on isolated network segments with strict access controls, not directly accessible from the internet.
- Audit stored credentials: After patching, rotate all credentials stored in the affected ManageEngine products, as they may have been exfiltrated during the vulnerability window.
- Review access logs: Examine ManageEngine access logs for unauthorized access, unusual credential retrievals, and signs of data exfiltration.
- Implement defense-in-depth: Deploy a WAF in front of ManageEngine services, enable multi-factor authentication for all administrative access, and implement network monitoring for unusual outbound connections from the ManageEngine server.
Technical Details
CVE-2022-35405 targets the web interface of Zoho ManageEngine PAM360, Password Manager Pro, and Access Manager Plus. The vulnerability exists in how the application processes certain requests, allowing remote code execution without authentication. The specific technical mechanism involves a deserialization or code injection flaw in the Java-based web application that can be triggered through crafted HTTP requests. Given that these products function as enterprise privileged access management systems, they typically run with elevated privileges and have network access to critical infrastructure components. Successful exploitation provides the attacker with access to the application's credential vault, which contains passwords, SSH keys, and certificates for the organization's most sensitive systems.
Frequently Asked Questions
Is CVE-2022-35405 being actively exploited?
Yes, CVE-2022-35405 is actively exploited. CISA added it to the KEV catalog on September 22, 2022. The EPSS score of 94.31% confirms near-certain exploitation activity, and the high-value nature of the affected credential management products makes them prime targets.
What products are affected by CVE-2022-35405?
CVE-2022-35405 affects Zoho ManageEngine PAM360 (before version 5510), Password Manager Pro (before version 12101), and Access Manager Plus (before version 4303).
How do I fix CVE-2022-35405?
Update the affected ManageEngine products to the latest patched versions. After patching, rotate all stored credentials as they may have been compromised.
How severe is CVE-2022-35405?
CVE-2022-35405 is a critical vulnerability with an EPSS score of 94.31% (99.95th percentile). It enables unauthenticated remote code execution on credential management systems, potentially exposing all stored enterprise passwords and secrets.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.