SecuriTricks - CVE-2025-11248

Description

ZohoCorp ManageEngine Endpoint Central versions prior to 11.4.2528.05 are vulnerable to a sensitive information logging issue. An authenticated user with access to the logs could potentially obtain the sensitive agent token.

Product(s) Impacted

Vendor	Product	Versions
Zoho	Manageengine Endpoint Central	<11.4.2528.05

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-532

Insertion of Sensitive Information into Log File

Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.

*CPE(s)

Affected systems and software identified for this CVE.

Type	Vendor	Product	Version	Update	Edition	Language	Software Edition	Target Software	Target Hardware	Other Information
a	zoho	manageengine_endpoint_central	<11.4.2528.05	/	/	/	/	/	/	/

References

https://www.manageengine.com/products/desktop-central/CVE-2025-11248.html

CVSS Score

3.2 / 10

CVSS Data - 3.1

Attack Vector: LOCAL
Attack Complexity: LOW
Privileges Required: LOW
Scope: CHANGED
Confidentiality Impact: LOW
Integrity Impact: NONE
Availability Impact: NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N

View Vector String

Timeline

Published: Oct. 27, 2025, 1:15 p.m.
Last Modified: Oct. 27, 2025, 1:19 p.m.

Status : Awaiting Analysis

CVE has been marked for Analysis. Normally once in this state the CVE will be analyzed by NVD staff within 24 hours.

More info

Source

0fc0942c-577d-436f-ae8e-945763c79b02

CVE-2025-11248