CVE-2022-47577

An issue was discovered in the endpoint protection agent in Zoho ManageEngine Device Control Plus 10.1.2228.15. Despite configuring complete restrictions on USB pendrives, USB HDD devices, memory cards, USB connections to mobile devices, etc., it is still possible to bypass the USB restrictions by making use of a virtual machine (VM). This allows a file to be exchanged outside the laptop/system. VMs can be created by any user (even without admin rights). The data exfiltration can occur without any record in the audit trail of Windows events on the host machine. NOTE: the vendor's position is "it's not a vulnerability in our product."

• https://medium.com/nestedif/vulnerability-disclosure-business-logic-unauthorized-data-exfiltration-bypassing-dlp-zoho-cc51465ba84aExploit, Third Party Advisory
• https://www.manageengine.com/device-control/how-to/device-control.htmlVendor Advisory
• https://medium.com/nestedif/vulnerability-disclosure-business-logic-unauthorized-data-exfiltration-bypassing-dlp-zoho-cc51465ba84aExploit, Third Party Advisory
• https://www.manageengine.com/device-control/how-to/device-control.htmlVendor Advisory

Published

Dec 20, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-47559Lack of device control over web requests in ekorCCP and ekor…8.8
• CVE-2022-4756The My YouTube Channel WordPress plugin before 3.23.0 does n…5.4
• CVE-2022-47560The lack of web request control on ekorCCP and ekorRCI devic…6.5
• CVE-2022-47561The web application stores credentials in clear text in the …5.5
• CVE-2022-47562Vulnerability in the RCPbind service running on UDP port (11…7.5
• CVE-2022-4757The List Pages Shortcode WordPress plugin before 1.7.6 does …5.4
• CVE-2022-47578An issue was discovered in the endpoint protection agent in …7.8
• CVE-2022-4758The 10WebMapBuilder WordPress plugin before 1.0.72 does not …5.4
• CVE-2022-47581Isode M-Vault 16.0v0 through 17.x before 17.0v24 can crash u…7.5
• CVE-2022-47583Terminal character injection in Mintty before 3.6.3 allows c…9.8
• CVE-2022-47586Unauth. SQL Injection (SQLi) vulnerability in Themefic Ultim…9.8
• CVE-2022-47587Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerabili…4.8