CVE-2019-17421

7.8 highEPSS 0.6%

High (7.8) in zohocorp. EPSS 0.6% chance of exploitation in the next 30 days.

Incorrect file permissions on the packaged Nipper executable file in Zoho ManageEngine OpManager 12.4.072 and Firewall Analyzer 12.4.072 allow local users to elevate privileges to root by overwriting this file with a malicious payload.

Severity

CVSS 3.1

7.8 high

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.6% chance of exploitation in the next 30 days; higher than 46% of CVEs (scores of 2026-10-31)
CWE: CWE-276
Published: 2019-11-21
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

zohocorp:manageengine_firewall_analyzer
zohocorp:manageengine_opmanager

References

https://blog.vastart.dev/2019/11/cve-2019-17421-privilege-escalation.html
https://twitter.com/va_start
https://www.manageengine.com/products/firewall/security-updates/cve-2019-17421.html
https://blog.vastart.dev/2019/11/cve-2019-17421-privilege-escalation.html
https://twitter.com/va_start

Check your stack JSON