CVE-2025-5496
BaseFortify
Publication date: 2025-10-21
Last updated on: 2025-10-28
Assigner: ManageEngine
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| zohocorp | manageengine_endpoint_central | to 11.4.2508.14 (exc) |
| zohocorp | manageengine_endpoint_central | From 11.4.2510.01 (inc) to 11.4.2516.06 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-269 | The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-5496 is a local privilege escalation vulnerability in the ManageEngine Endpoint Central agent binary dcconfig.exe. It involves the agent performing privileged arbitrary file deletion during policy refresh, which an attacker with local access can exploit to escalate their privileges to SYSTEM level. [1]
How can this vulnerability impact me? :
This vulnerability can allow an attacker with local access to delete arbitrary files with elevated privileges, enabling them to escalate their privileges to SYSTEM level. This could lead to unauthorized control over the affected system and potentially compromise its security. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability is a local privilege escalation issue involving the Endpoint Central agent binary dcconfig.exe performing privileged file deletion during policy refresh. Detection involves verifying the version of the Endpoint Central agent installed on your system to see if it is earlier than 11.4.2508.14, 11.4.2516.06, or 11.4.2518.01. You can check the version of dcconfig.exe or the Endpoint Central agent by running commands such as 'dcconfig.exe /version' or checking the file properties. There are no specific network detection commands provided. [1]
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, immediately update the Endpoint Central agent to one of the fixed builds: 11.4.2518.01, 11.4.2508.14, or 11.4.2516.06. This can be done by logging into the Endpoint Central console, clicking on the current build number, and downloading and installing the latest applicable Patch/PPM update. This applies to both On-Premises and Cloud versions of Endpoint Central. [1]