CVE-2015-9107

Critical

Published: 04/08/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

Zoho ManageEngine OpManager versions 11 through 12.2 uses a custom encryption algorithm to protect the credentials used to access monitored devices. The implemented algorithm does not use a per-system key or even a salt, making it possible to create a universal decryptor.

Risk Assessment

The lack of proper credential protection may lead to unauthorized access to monitored devices, posing a serious security threat to the organization.

Recommendation

It is recommended to upgrade to the latest version of the software that improves encryption mechanisms and implements better security practices.

Original NVD description (English source)

Zoho ManageEngine OpManager 11 through 12.2 uses a custom encryption algorithm to protect the credential used to access the monitored devices. The implemented algorithm doesn't use a per-system key or even a salt; therefore, it's possible to create a universal decryptor.