Executive Summary

CVE-2025-5496 is a local privilege escalation vulnerability in the ManageEngine Endpoint Central agent binary dcconfig.exe. It involves the agent performing privileged arbitrary file deletion during policy refresh, which an attacker with local access can exploit to escalate their privileges to SYSTEM level. [1]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an attacker with local access to delete arbitrary files with elevated privileges, enabling them to escalate their privileges to SYSTEM level. This could lead to unauthorized control over the affected system and potentially compromise its security. [1]

Useful 0 Not Useful 0

Detection Guidance

This vulnerability is a local privilege escalation issue involving the Endpoint Central agent binary dcconfig.exe performing privileged file deletion during policy refresh. Detection involves verifying the version of the Endpoint Central agent installed on your system to see if it is earlier than 11.4.2508.14, 11.4.2516.06, or 11.4.2518.01. You can check the version of dcconfig.exe or the Endpoint Central agent by running commands such as 'dcconfig.exe /version' or checking the file properties. There are no specific network detection commands provided. [1]

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, immediately update the Endpoint Central agent to one of the fixed builds: 11.4.2518.01, 11.4.2508.14, or 11.4.2516.06. This can be done by logging into the Endpoint Central console, clicking on the current build number, and downloading and installing the latest applicable Patch/PPM update. This applies to both On-Premises and Cloud versions of Endpoint Central. [1]

Useful 0 Not Useful 0