Home » Features » Security Updates

Security Update: Fix for Remote Code Execution Issue Limited to Authenticated Admin-Level Users

This document addresses a medium-severity vulnerability identified in specific configuration scenarios, which could potentially allow remote code execution in specific cases.

Severity: Medium

Fixed Builds:

  • Build: For builds below 11.3.2428.21, upgrade to 11.3.2428.22 or above
  • Build: For builds between 11.3.2429.01 and 11.3.2440.04, upgrade to 11.3.2440.05 or above

Release Date: November 2024

Reported by: Zewei Zhang from NSFOCUS TIANJI Lab via ZohoCorp Bug Bounty Program

What was the problem?

During specific configuration scenarios, an authenticated admin user could exploit a configuration flaw to perform remote code execution. This issue originated from third-party libraries and has been resolved by upgrading these components.

Note: This issue is not applicable to cloud versions of the product. 

How do I fix it?

Upgrading to the latest version is strongly advised due to the critical nature of this vulnerability. To upgrade, follow the steps below:

  • Log in to the product console, and click on your current build number in the top-right corner.
  • Locate the latest build applicable to you.
  • Download the PPM and update the product to the latest version.

If you have any questions or require additional information regarding this update, please don't hesitate to contact our support.

Back to Top