CVE-2022-37024: 
Zoho ManageEngine NetFlow Analyzer vulnerability analysis and mitigation

A Remote Code Execution (RCE) vulnerability was discovered in Zoho ManageEngine products (OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, and OpUtils) before versions released between 2022-07-29 and 2022-07-30. The vulnerability, identified as CVE-2022-37024, was reported by an anonymous researcher working with Trend Micro Zero Day Initiative. The issue specifically affects IPv6 address management functionality (ManageEngine Advisory, CVE Mitre).

The vulnerability exists within the getDNSResolveOption function and stems from insufficient validation of user-supplied strings before their use in system calls. The vulnerability has been assigned a CVSS score of 7.2 (High) with the vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, indicating that it requires network access and high privileges but no user interaction to exploit (ZDI Advisory).

When successfully exploited, the vulnerability allows authenticated users to make unauthorized database changes that can lead to remote code execution. The attacker can leverage this vulnerability to execute code in the context of SYSTEM, potentially gaining complete control over the affected system (ZDI Advisory, ManageEngine Advisory).

The vulnerability requires authentication to exploit, making it somewhat less severe than unauthenticated vulnerabilities. The specific flaw exists in the IPv6 address management functionality and can be exploited through the getDNSResolveOption function (ZDI Advisory).

ManageEngine has released fixed versions (builds 125658, 126003, 126105, and 126120) to address this vulnerability. Users are advised to upgrade to the latest version of their respective products through the official service pack downloads available on the ManageEngine website. The vulnerability was patched between July 29-30, 2022 (ManageEngine Advisory).