CVE-2022-47578

An issue was discovered in the endpoint protection agent in Zoho ManageEngine Device Control Plus 10.1.2228.15. Despite configuring complete restrictions on USB pendrives, USB HDD devices, memory cards, USB connections to mobile devices, etc., it is still possible to bypass the USB restrictions by booting into Safe Mode. This allows a file to be exchanged outside the laptop/system. Safe Mode can be launched by any user (even without admin rights). Data exfiltration can occur, and also malware might be introduced onto the system. NOTE: the vendor's position is "it's not a vulnerability in our product."

• CWE-288

• https://medium.com/nestedif/vulnerability-disclosure-business-logic-unauthorized-data-exfiltration-bypassing-dlp-zoho-cc51465ba84aExploit, Third Party Advisory
• https://www.manageengine.com/device-control/how-to/device-control.htmlVendor Advisory
• https://medium.com/nestedif/vulnerability-disclosure-business-logic-unauthorized-data-exfiltration-bypassing-dlp-zoho-cc51465ba84aExploit, Third Party Advisory
• https://www.manageengine.com/device-control/how-to/device-control.htmlVendor Advisory

Published

Dec 20, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-4756The My YouTube Channel WordPress plugin before 3.23.0 does n…5.4
• CVE-2022-47560The lack of web request control on ekorCCP and ekorRCI devic…6.5
• CVE-2022-47561The web application stores credentials in clear text in the …5.5
• CVE-2022-47562Vulnerability in the RCPbind service running on UDP port (11…7.5
• CVE-2022-4757The List Pages Shortcode WordPress plugin before 1.7.6 does …5.4
• CVE-2022-47577An issue was discovered in the endpoint protection agent in …7.8
• CVE-2022-4758The 10WebMapBuilder WordPress plugin before 1.0.72 does not …5.4
• CVE-2022-47581Isode M-Vault 16.0v0 through 17.x before 17.0v24 can crash u…7.5
• CVE-2022-47583Terminal character injection in Mintty before 3.6.3 allows c…9.8
• CVE-2022-47586Unauth. SQL Injection (SQLi) vulnerability in Themefic Ultim…9.8
• CVE-2022-47587Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerabili…4.8
• CVE-2022-47588Improper Neutralization of Special Elements used in an SQL C…9.8