ManageEngine

A severe security vulnerability identified as CVE-2025-3835 has been found in ManageEngine Exchange Reporter Plus. This vulnerability allows attackers to execute arbitrary commands on target servers through a flaw in the Content Search module. The vulnerability affects all installations with build 5721 and below. Security experts advise immediate updates to prevent complete system compromise, potential data breaches, and further malicious activities such as ransomware deployment.

Source: https://cybersecuritynews.com/manageengine-exchange-reporter-plus-vulnerability/

TPRM report: https://scoringcyber.rankiteo.com/company/manageengine

"id": "man144061025",
"linkid": "manageengine",
"type": "Vulnerability",
"date": "6/2025",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"

{'affected_entities': [{'customers_affected': 'All organizations using the '
                                              'affected software',
                        'industry': 'Technology',
                        'name': 'ManageEngine',
                        'type': 'Software Vendor'}],
 'attack_vector': 'Exploiting input validation flaw in the Content Search '
                  'module',
 'description': 'A severe security vulnerability has been identified in '
                'ManageEngine Exchange Reporter Plus that could allow '
                'attackers to execute arbitrary commands on target servers.',
 'impact': {'systems_affected': 'All Exchange Reporter Plus installations with '
                                'build 5721 and below'},
 'initial_access_broker': {'entry_point': 'Content Search module',
                           'high_value_targets': ['Financial institutions',
                                                  'Government agencies',
                                                  'Large enterprises']},
 'motivation': ['Complete system compromise',
                'Potential data breaches',
                'Establish persistent access',
                'Move laterally within networks',
                'Exfiltrate sensitive data',
                'Deploy additional malicious payloads such as ransomware'],
 'post_incident_analysis': {'corrective_actions': ['Implement proper input '
                                                   'validation and '
                                                   'sanitization in the '
                                                   'Content Search module'],
                            'root_causes': 'Input validation flaw in the '
                                           'Content Search module'},
 'recommendations': ['Update immediately to build 5722 or higher',
                     'Restrict network access to Exchange Reporter Plus '
                     'instances',
                     'Implement additional network segmentation',
                     'Enhance monitoring for suspicious activities targeting '
                     'the vulnerable component'],
 'response': {'containment_measures': ['Restricting network access to Exchange '
                                       'Reporter Plus instances',
                                       'Implementing additional network '
                                       'segmentation',
                                       'Enhancing monitoring for suspicious '
                                       'activities targeting the vulnerable '
                                       'component'],
              'enhanced_monitoring': ['Enhancing monitoring for suspicious '
                                      'activities targeting the vulnerable '
                                      'component'],
              'network_segmentation': ['Implementing additional network '
                                       'segmentation'],
              'remediation_measures': ['Apply the patch to existing '
                                       'installations following the documented '
                                       'procedure',
                                       'Verify successful update by confirming '
                                       'the build number has changed to 5722 '
                                       'or higher']},
 'title': 'ManageEngine Exchange Reporter Plus RCE Flaw',
 'type': 'Remote Code Execution (RCE)',
 'vulnerability_exploited': 'CVE-2025-3835'}