« Volver al listado

CVE-2025-11670

Estado: AnalizadaMedia (4.3)—

Zohocorp ManageEngine ADManager Plus versions before 8025 are vulnerable to NTLM Hash Exposure.  This vulnerability is exploitable only by technicians who have the “Impersonate as Admin” option enabled.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Zohocorp — Manageengine Admanager Plus

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-11670",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-11670",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-12-15T13:11:02.867665Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "0fc0942c-577d-436f-ae8e-945763c79b02",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 6.4,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 3.1
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "0fc0942c-577d-436f-ae8e-945763c79b02",
      "affectedData": [
        {
          "vendor": "Zohocorp",
          "product": "ManageEngine ADManager Plus",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "8025",
              "versionType": "8025"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-12-15T11:15:38.607",
  "references": [
    {
      "url": "https://www.manageengine.com/products/ad-manager/admanager-kb/cve-2025-11670.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "0fc0942c-577d-436f-ae8e-945763c79b02"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "0fc0942c-577d-436f-ae8e-945763c79b02",
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Zohocorp ManageEngine ADManager Plus versions before 8025 are vulnerable to NTLM Hash Exposure. \nThis vulnerability is exploitable only by technicians who have the “Impersonate as Admin” option enabled."
    },
    {
      "lang": "es",
      "value": "Las versiones de Zohocorp ManageEngine ADManager Plus anteriores a la 8025 son vulnerables a la Exposición de Hash NTLM.\nEsta vulnerabilidad es explotable solo por técnicos que tienen la opción 'Suplantar como administrador' habilitada."
    }
  ],
  "lastModified": "2026-09-30T23:10:00.237",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:zohocorp:manageengine_admanager_plus:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "35D63C02-129E-43A5-AB58-E2246679811B",
              "versionEndExcluding": "8.0"
            },
            {
              "criteria": "cpe:2.3:a:zohocorp:manageengine_admanager_plus:8.0:8000:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4C4EF8A9-A448-48F7-9FEC-33580DE461C6"
            },
            {
              "criteria": "cpe:2.3:a:zohocorp:manageengine_admanager_plus:8.0:8001:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EA01C510-9E1D-4F00-9D65-6305A69E533E"
            },
            {
              "criteria": "cpe:2.3:a:zohocorp:manageengine_admanager_plus:8.0:8002:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "629EAF0E-6444-4E3A-AE0B-A00382ED951D"
            },
            {
              "criteria": "cpe:2.3:a:zohocorp:manageengine_admanager_plus:8.0:8010:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "48B2B35E-9D79-4515-B0F9-260D71D45756"
            },
            {
              "criteria": "cpe:2.3:a:zohocorp:manageengine_admanager_plus:8.0:8011:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3EE35042-E248-41D7-AD60-123EB1C459FA"
            },
            {
              "criteria": "cpe:2.3:a:zohocorp:manageengine_admanager_plus:8.0:8012:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "519D71D4-1905-4FDA-9F46-F3152B84D633"
            },
            {
              "criteria": "cpe:2.3:a:zohocorp:manageengine_admanager_plus:8.0:8020:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4DE86032-9A43-45C3-8FEC-5C069C7AE793"
            },
            {
              "criteria": "cpe:2.3:a:zohocorp:manageengine_admanager_plus:8.0:8021:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7276041D-D6A3-4164-849C-855765D5FF10"
            },
            {
              "criteria": "cpe:2.3:a:zohocorp:manageengine_admanager_plus:8.0:8022:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "009F7D2E-D2DF-4B54-B48B-CF720E41153C"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "0fc0942c-577d-436f-ae8e-945763c79b02"
}