CVE-2025-5342: 
Zoho ManageEngine Exchange Reporter Plus vulnerability analysis and mitigation

CVE-2025-5342 affects Zohocorp ManageEngine Exchange Reporter Plus through version 5721, involving a Regular expression Denial of Service (ReDoS) vulnerability in the search module. The vulnerability was discovered by Ngockhanhc311 from FPT NightWolf and was disclosed on October 30, 2025. The issue was fixed in build 5722, released on May 29, 2025 (ManageEngine Advisory, NVD).

The vulnerability is classified with a CVSS v3.1 Base Score of 6.5 (MEDIUM) according to NVD's assessment (Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), while ManageEngine's own assessment rates it at 4.3 (MEDIUM) (Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L). The vulnerability is associated with CWE-1333 (Inefficient Regular Expression Complexity) and CWE-400 (Uncontrolled Resource Consumption) (NVD).

The vulnerability could allow authenticated attackers to interrupt searches within the Content Search module, potentially causing operational disruption to the system (ManageEngine Advisory).

ManageEngine has released build 5722 to address this vulnerability. Users are strongly advised to update their Exchange Reporter Plus installation to the latest build immediately. The update can be applied by downloading and installing the latest service pack from the ManageEngine website (ManageEngine Advisory).