CVE-2019-17602

CRITICAL

An issue was discovered in Zoho ManageEngine OpManager before 12.4 build 124089. The OPMDeviceDetailsServlet servlet is prone to SQL injection. Depending on the configuration, this vulnerability could be exploited unauthenticated or authenticated.

Published: Oct 15, 2019 Modified: Jun 17, 2026

CWE-89

CVSS Metrics

CVSSv3

Attack Vector: NETWORK Attack Complexity: LOW Privileges Required: NONE User Interaction: NONE Scope: UNCHANGED Confidentiality Impact: HIGH Integrity Impact: HIGH Availability Impact: HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected Products (41)

Vendor	Product	Version
zohocorp	manageengine_opmanager	* < 12.4
zohocorp	manageengine_opmanager	12.4
zohocorp	manageengine_opmanager	12.4
zohocorp	manageengine_opmanager	12.4
zohocorp	manageengine_opmanager	12.4
zohocorp	manageengine_opmanager	12.4
zohocorp	manageengine_opmanager	12.4
zohocorp	manageengine_opmanager	12.4
zohocorp	manageengine_opmanager	12.4
zohocorp	manageengine_opmanager	12.4
zohocorp	manageengine_opmanager	12.4
zohocorp	manageengine_opmanager	12.4
zohocorp	manageengine_opmanager	12.4
zohocorp	manageengine_opmanager	12.4
zohocorp	manageengine_opmanager	12.4
zohocorp	manageengine_opmanager	12.4
zohocorp	manageengine_opmanager	12.4
zohocorp	manageengine_opmanager	12.4
zohocorp	manageengine_opmanager	12.4
zohocorp	manageengine_opmanager	12.4

…and 21 more

GitHub Security Advisory GHSA-c53x-hwmf-5w37

An issue was discovered in Zoho ManageEngine OpManager before 12.4 build 124089. The...

References (2)

https://www.manageengine.com/network-monitoring/help/read-me-complete.html Release Notes, Vendor Advisory
https://www.manageengine.com/network-monitoring/help/read-me-complete.html Release Notes, Vendor Advisory

Risk Scores

CVSS Score 9.8 / 10

EPSS Score 81.55%

Top 0% most likely to be exploited

Threat Score 73.7 / 100

Data Sources

NVD EPSS GitHub