Home » Features » Security Updates

Security Update: Fix for Remote Code Execution Issue Limited to Authenticated Admin-Level Users

This document addresses a medium-severity vulnerability identified in specific configuration scenarios, which could potentially allow remote code execution in specific cases.

Severity: Medium

Fixed Builds:

  • Build: For builds below 11.3.2428.21, upgrade to 11.3.2428.22 or above
  • Build: For builds between 11.3.2429.01 and 11.3.2440.04, upgrade to 11.3.2440.05 or above

Release Date: November 2024

Reported by: Zewei Zhang from NSFOCUS TIANJI Lab via ZohoCorp Bug Bounty Program

What was the problem?

During specific configuration scenarios, an authenticated admin user could exploit a configuration flaw to perform remote code execution. This issue originated from third-party libraries and has been resolved by upgrading these components.

Note: This issue is not applicable to cloud versions of the product. 

How do I fix it?

Upgrading to the latest version is strongly advised due to the critical nature of this vulnerability. To upgrade, follow the steps below:

  • Log in to the product console, and click on your current build number in the top-right corner.
  • Locate the latest build applicable to you.
  • Download the PPM and update the product to the latest version.

If you have any questions or require additional information regarding this update, please don't hesitate to contact our support.