A command injection vulnerability in ManageEngine OpManager and Firewall Analyzer allows low-privilege authenticated users to execute arbitrary commands on the host system.

The Diagnose Settings feature fails to properly sanitize user input, allowing an authenticated low-privilege user to inject and execute arbitrary CLI commands. This vulnerability affects the core functionality of the monitoring software.

Successful exploitation results in full command execution on the server hosting the ManageEngine instance. This grants the attacker significant control over the environment, potentially allowing them to compromise monitored firewalls, access sensitive network configurations, or escalate privileges. The CVSS score of 8.8 highlights the critical risk posed to the management infrastructure.

Immediate Action: Update ManageEngine OpManager and Firewall Analyzer to version 12.8.710 or 12.9.124 as recommended by the vendor.

Proactive Monitoring: Audit application logs for suspicious activity within the Diagnose Settings feature and monitor for unexpected system process creation.

Compensating Controls: Limit access to the administrative interface of these applications to only authorized personnel and trusted management IP addresses.

Public Exploit Available: Unknown

This vulnerability directly impacts the security of the management plane. Administrators must apply the identified patch immediately to prevent potential exploitation and secure the integrity of the network monitoring system.