LiveActive security incident?Get immediate response
CVE Record

CVE-2018-18980: An XML External Entity injection (XXE) vulnerability exists in Zoho ManageEngine Network Configuration Mana...

An XML External Entity injection (XXE) vulnerability exists in Zoho ManageEngine Network Configuration Manager and OpManager before 12.3.214 via the RequestXML parameter in a /devices/ProcessRequest.do GET request. For example, the attacker can trigger the transmission of local files to an arbitrary remote FTP server.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

CVE-2018-18980 is an XXE flaw in Zoho ManageEngine Network Configuration Manager and OpManager before 12.3.214. The reported impact is local file transmission to an attacker-controlled FTP server. Prioritize exposed or old deployments, but the source bundle does not confirm CVSS, authentication requirements, or active exploitation.

Executive priority

Treat this as a high-priority legacy exposure issue for any still-running affected ManageEngine systems. Network management tools often contain sensitive infrastructure data, and the described impact is file exfiltration. Urgency is lower only where no affected versions exist or access is tightly restricted.

Technical view

The issue is XML External Entity injection through the RequestXML parameter on /devices/ProcessRequest.do. Affected products are ManageEngine Network Configuration Manager and OpManager before 12.3.214. The bundle describes file exfiltration behavior, but omits CWE mapping, CVSS vector, exploit maturity, and detailed vendor remediation text.

Likely exposure

Exposure is most likely where affected ManageEngine NCM or OpManager instances below 12.3.214 are reachable by untrusted users or networks. Internet exposure would increase urgency, but the sources do not state required authentication or default reachability.

Exploitation context

The CVE description includes an example impact: triggering transmission of local files to an arbitrary remote FTP server. The bundle does not show CISA KEV listing, confirmed active exploitation, or reliable exploit prevalence.

Researcher notes

The public bundle supports XXE and local file exfiltration impact, but leaves important gaps: authentication, exact fixed release notes, CVSS, and exploit status. Avoid assuming unauthenticated remote exploitation unless confirmed by additional vendor or authoritative sources.

Mitigation direction

  • Identify ManageEngine NCM and OpManager instances and versions.
  • Upgrade affected products to 12.3.214 or later if vendor guidance supports it.
  • Restrict access to management interfaces from untrusted networks.
  • Review vendor release notes and advisories for current remediation guidance.
  • Monitor for unexpected outbound FTP connections from affected servers.

Validation and detection

  • Inventory NCM and OpManager versions across production and backup systems.
  • Confirm whether any instance is below 12.3.214.
  • Check whether /devices/ProcessRequest.do is reachable from untrusted networks.
  • Review logs for suspicious RequestXML activity and outbound FTP attempts.
  • Verify upgrade status against ManageEngine release documentation.
Prepared
Confidence
medium
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2018-18980 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
3Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.