{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-06-17T03:17:21.112","vulnerabilities":[{"cve":{"id":"CVE-2022-47578","sourceIdentifier":"cve@mitre.org","published":"2022-12-20T04:15:09.883","lastModified":"2024-11-21T07:32:12.360","vulnStatus":"Modified","cveTags":[{"sourceIdentifier":"cve@mitre.org","tags":["disputed"]}],"descriptions":[{"lang":"en","value":"An issue was discovered in the endpoint protection agent in Zoho ManageEngine Device Control Plus 10.1.2228.15. Despite configuring complete restrictions on USB pendrives, USB HDD devices, memory cards, USB connections to mobile devices, etc., it is still possible to bypass the USB restrictions by booting into Safe Mode. This allows a file to be exchanged outside the laptop/system. Safe Mode can be launched by any user (even without admin rights). Data exfiltration can occur, and also malware might be introduced onto the system. NOTE: the vendor's position is \"it's not a vulnerability in our product.\""},{"lang":"es","value":"** EN DISPUTA ** Se descubrió un problema en el agente de protección de endpoints en Zoho ManageEngine Device Control Plus 10.1.2228.15. A pesar de configurar restricciones completas en pendrives USB, dispositivos HDD USB, tarjetas de memoria, conexiones USB a dispositivos móviles, etc., aún es posible evitar las restricciones USB iniciando en Modo seguro. Esto permite intercambiar un archivo fuera de la computadora portátil/sistema. Cualquier usuario puede iniciar el Modo seguro (incluso sin derechos de administrador). Puede producirse una filtración de datos y también puede introducirse malware en el sistema. NOTA: la posición del proveedor es \"no es una vulnerabilidad en nuestro producto\"."}],"metrics":{"cvssMetricV31":[{"source":"cve@mitre.org","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":1.8,"impactScore":5.2},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"NVD-CWE-noinfo"}]},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-288"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:zohocorp:manageengine_device_control_plus:10.1.2228.15:*:*:*:*:*:*:*","matchCriteriaId":"8DF55C54-54D8-4599-AE20-C216D2EA5F27"}]}]}],"references":[{"url":"https://medium.com/nestedif/vulnerability-disclosure-business-logic-unauthorized-data-exfiltration-bypassing-dlp-zoho-cc51465ba84a","source":"cve@mitre.org","tags":["Exploit","Third Party Advisory"]},{"url":"https://www.manageengine.com/device-control/how-to/device-control.html","source":"cve@mitre.org","tags":["Vendor Advisory"]},{"url":"https://medium.com/nestedif/vulnerability-disclosure-business-logic-unauthorized-data-exfiltration-bypassing-dlp-zoho-cc51465ba84a","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory"]},{"url":"https://www.manageengine.com/device-control/how-to/device-control.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]}]}}]}