« Volver al listado

CVE-2025-8309

Estado: AplazadaAlta (8.1)—

There is an improper privilege management vulnerability identified in ManageEngine's Asset Explorer, ServiceDesk Plus, ServiceDesk Plus MSP, and SupportCenter Plus products by Zohocorp.

This vulnerability impacts Asset Explorer versions before 7710, ServiceDesk Plus versions before 15110, ServiceDesk Plus MSP versions before 14940, and SupportCenter Plus versions before 14940.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Vector CVSS indica acceso en red con autenticación (PR:L), sin interacción del usuario. CWE-269 es improper privilege management. La pista sugiere T1210 (explotación de servicio remoto con privilegios) e impacto T1068 (escalada de privilegios).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Threat Intelligence ProgramApplication Isolation and SandboxingExploit ProtectionUpdate SoftwareVulnerability ScanningPrivileged Account Management

Tecnologías afectadas (4)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Zohocorp — Asset ExplorerAIZohocorp — Servicedesk PlusAIZohocorp — Servicedesk Plus MSPAIZohocorp — Supportcenter PlusAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-8309",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-8309",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-08-21T03:55:16.679483Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "0fc0942c-577d-436f-ae8e-945763c79b02",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.1,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "0fc0942c-577d-436f-ae8e-945763c79b02",
      "affectedData": [
        {
          "vendor": "ManageEngine",
          "product": "Asset Explorer",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "7710",
              "versionType": "7710"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "ManageEngine",
          "product": "ServiceDesk Plus",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "15110",
              "versionType": "15110"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "ManageEngine",
          "product": "ServiceDesk Plus MSP",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "14940",
              "versionType": "14940"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "ManageEngine",
          "product": "SupportCenter Plus",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "14940",
              "versionType": "14940"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-08-20T17:15:37.783",
  "references": [
    {
      "url": "https://www.manageengine.com/products/service-desk/cve-2025-8309.html",
      "source": "0fc0942c-577d-436f-ae8e-945763c79b02"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "0fc0942c-577d-436f-ae8e-945763c79b02",
      "description": [
        {
          "lang": "en",
          "value": "CWE-269"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "There is an improper privilege management vulnerability identified in ManageEngine's Asset Explorer, ServiceDesk Plus, ServiceDesk Plus MSP, and SupportCenter Plus products by Zohocorp. \n\nThis vulnerability impacts Asset Explorer versions before 7710, ServiceDesk Plus versions before 15110, ServiceDesk Plus MSP versions before 14940, and SupportCenter Plus versions before 14940."
    },
    {
      "lang": "es",
      "value": "Zohocorp ha identificado una vulnerabilidad de gestión de privilegios incorrecta en ManageEngine's Asset Explorer, ServiceDesk Plus, ServiceDesk Plus MSP, y SupportCenter Plus products by Zohocorp. Esta vulnerabilidad afecta a las versiones de Asset Explorer anteriores a la 7710, ServiceDesk Plus anteriores a la 15110, ServiceDesk Plus MSP anteriores a la 14940 y SupportCenter Plus anteriores a la 14940."
    }
  ],
  "lastModified": "2026-06-17T10:06:43.300",
  "sourceIdentifier": "0fc0942c-577d-436f-ae8e-945763c79b02"
}