PT-2020-14514 · Zoho · Zoho Manageengine Desktop Central

Pat0Is · Published 2020-07-29 · Updated 2022-04-28 · CVE-2020-15588

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Desktop Central version 10.0.552.W

Description An issue in the client side of the software allows an attacker-controlled server to trigger an integer overflow in InternetSendRequestEx and InternetSendRequestByBitrate, leading to a heap-based buffer overflow and Remote Code Execution with SYSTEM privileges. This occurs when untrusted communication is initiated with a server.

Recommendations For Zoho ManageEngine Desktop Central version 10.0.552.W, consider restricting untrusted communication with servers to minimize the risk of exploitation. As a temporary workaround, ensure that agents only connect with trusted communication. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Integer Overflow

Memory Corruption

Weakness Enumeration

CWE-190

CWE-787

Related Identifiers

CVE-2020-15588

Affected Products

Zoho Manageengine Desktop Central

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2020-15588 · Security Note
• https://manageengine.com/products/desktop-central/integer-overflow-vulnerability.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-15588 · Vendor Advisory