CVE-2022-47578 : An issue was discovered in the endpoint protection agent in Zoho ManageEngine De

An issue was discovered in the endpoint protection agent in Zoho ManageEngine Device Control Plus 10.1.2228.15. Despite configuring complete restrictions on USB pendrives, USB HDD devices, memory cards, USB connections to mobile devices, etc., it is still possible to bypass the USB restrictions by booting into Safe Mode. This allows a file to be exchanged outside the laptop/system. Safe Mode can be launched by any user (even without admin rights). Data exfiltration can occur, and also malware might be introduced onto the system. NOTE: the vendor's position is "it's not a vulnerability in our product."

Published 2022-12-20 04:15:10

Updated 2024-08-03 15:15:50

Source MITRE

View at NVD, CVE.org

Products affected by CVE-2022-47578

Zohocorp » Manageengine Device Control Plus » Version: 10.1.2228.15
cpe:2.3:a:zohocorp:manageengine_device_control_plus:10.1.2228.15:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2022-47578

EPSS FAQ

0.01%

Probability of exploitation activity in the next 30 days EPSS Score History

~ %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2022-47578

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
7.1	HIGH	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N	1.8	5.2	MITRE
Attack Vector: Local Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: None
7.8	HIGH	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	1.8	5.9	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2022-47578

CWE-288 Authentication Bypass Using an Alternate Path or Channel

The product requires authentication, but the product has an alternate path or channel that does not require authentication.

Assigned by: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

References for CVE-2022-47578

https://medium.com/nestedif/vulnerability-disclosure-business-logic-unauthorized-data-exfiltration-bypassing-dlp-zoho-cc51465ba84a

Vulnerability Disclosure -Business logic: Unauthorised Data Exfiltration Bypassing DLP @ Zoho Device Control Plus | by Kartik Lalan | NestedIf | Dec, 2022 | Medium
Exploit;Third Party Advisory

CVEs referencing this url
https://www.manageengine.com/device-control/how-to/device-control.html

Device Control - ManageEngine Device Control Plus
Vendor Advisory

CVEs referencing this url

Jump to

Vulnerability Details : CVE-2022-47578

Products affected by CVE-2022-47578

Exploit prediction scoring system (EPSS) score for CVE-2022-47578

CVSS scores for CVE-2022-47578

CWE ids for CVE-2022-47578

References for CVE-2022-47578