CVE-2019-17602: Zoho ManageEngine OpManager OPMDeviceDetailsServlet SQL injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

critical priorityCVSS 9.8 with network reachability, no required privileges or interaction, and a very high EPSS probability make this a top remediation priority despite the absence of KEV listing.

What it is

Zoho ManageEngine OpManager before 12.4 build 124089 contains a SQL injection flaw in the OPMDeviceDetailsServlet servlet. Depending on configuration, the flaw can be reached without authentication, making it a serious risk for exposed instances.

Impact

An attacker can inject SQL through the servlet to read or alter database contents, and with the reported CVSS impact scope potentially gain broad control over confidentiality, integrity and availability.

Attack surface

The vulnerability is network reachable via the OPMDeviceDetailsServlet HTTP endpoint. The description states it may be exploitable unauthenticated or authenticated depending on configuration, and the CVSS vector indicates no privileges or user interaction are required.

Exploitation

Not listed in CISA KEV and no public exploit references are provided, but EPSS is very high at 0.81549 (99.6th percentile), indicating elevated likelihood of exploitation activity.

What to do

• Upgrade OpManager to version 12.4 build 124089 or later as specified in the vendor release notes.
• If immediate upgrade is not possible, restrict network access to the OpManager web interface and the OPMDeviceDetailsServlet endpoint to trusted management networks.
• Require authentication for all OpManager web endpoints where configuration permits, reducing the unauthenticated attack path.
• Review database and application logs for anomalous SQL activity against OpManager and apply least-privilege database permissions for the OpManager service account.

Detection

• Monitor web server and application logs for requests to OPMDeviceDetailsServlet containing SQL metacharacters or unusual query parameters.
• Alert on database errors or unexpected SQL statements originating from the OpManager application account.
• Baseline normal OpManager servlet traffic and flag deviations in request volume, source IPs or payload patterns to that endpoint.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.