CVE-2019-12196: Zoho ManageEngine NetFlow Analyzer SQL injection in compareReport

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

critical priorityCVSS 9.8 with network reachability, no authentication and no user interaction, combined with a high EPSS score, makes this a top remediation priority.

What it is

The compareReport endpoint in Zoho ManageEngine NetFlow Analyzer 12.3 fails to sanitize the DeviceID parameter, allowing SQL injection. An unauthenticated remote attacker can inject arbitrary SQL, which threatens the confidentiality, integrity and availability of the underlying database.

Impact

An attacker can execute arbitrary SQL commands against the application database, potentially reading, modifying or deleting data and, depending on database privileges, affecting the host.

Attack surface

Reachable over the network through the /client/api/json/v2/nfareports/compareReport endpoint via the DeviceID parameter. The CVSS vector indicates no authentication and no user interaction are required.

Exploitation

Not listed in CISA KEV and no public exploit tag is present in the references, but EPSS is high at roughly 0.69 (99th percentile), indicating substantial predicted exploitation activity.

What to do

• Upgrade NetFlow Analyzer to the fixed build referenced in the vendor advisory (readme 124029) or later.
• If patching is delayed, restrict network access to the compareReport API endpoint to trusted management hosts only.
• Validate and parameterize the DeviceID input at the application layer and review other report endpoints for the same pattern.
• Run the NetFlow Analyzer database with least-privilege credentials to limit the impact of successful injection.

Detection

• Inspect web and proxy logs for requests to /client/api/json/v2/nfareports/compareReport with suspicious or malformed DeviceID values.
• Alert on SQL metacharacters and keywords (quotes, UNION, SELECT, sleep, waitfor) in DeviceID parameters.
• Monitor database logs for anomalous queries or errors originating from the NetFlow Analyzer application account.
• Watch for unexpected outbound connections or data exfiltration from the NetFlow Analyzer host.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.