CVE-2020-10189
CriticalActively exploited (CISA KEV)
Description
Zoho ManageEngine Desktop Central before 10.0.474 allows remote code execution because of deserialization of untrusted data in getChartImage in the FileStorage class. This is related to the CewolfServlet and MDMLogUploaderServlet servlets.
SeverityCritical
CVSS9.8
Exploit probability—
Product
Zoho ManageEngine
PublishedMar 6, 2020
First seenMar 6, 2020
Added to KEVNov 3, 2021
Weakness typeCWE-502Deserialization of untrusted data
How to fix
CISA required action
Apply updates per vendor instructions.
CISA due date: May 3, 2022Update
- zohocorp manageengine_desktop_central10.0.479 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| zohocorp manageengine_desktop_central | v < 10.0.479 | 10.0.479 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.