CVE-2015-9107 Weak cryptography in n/a

Critical 9.8 Published 4 Aug 2017 Updated 6 Aug 2024

Attackers can decrypt stored device credentials using a universal decryptor due to weak custom encryption, potentially gaining unauthorized access to monitored devices.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2015-9107?

CVE-2015-9107 is a critical vulnerability in Zohocorp Manageengine Opmanager, published on 4 Aug 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Zoho ManageEngine OpManager 11 through 12.2 uses a custom encryption algorithm to protect the credential used to access the monitored devices. The implemented algorithm doesn't use a per-system key or even a salt; therefore, it's possible to create a universal decryptor.

Weakness: CWE-310

Which versions are affected by CVE-2015-9107?

It affects 1 product.

Products include Zohocorp Manageengine Opmanager.

How do I fix CVE-2015-9107?

No fix has been published for CVE-2015-9107 yet. Limit exposure of the affected software until one is available.

Is CVE-2015-9107 being exploited?

There is no known exploitation of CVE-2015-9107 in the wild and no public exploit code.

All Zohocorp Manageengine Opmanager vulnerabilities

Sources

Also known as GHSA-6r6j-h6w5-mj5v.