PT-2020-15728 · Zoho · Zoho Manageengine Desktop Central

Pat0Is · Published 2020-10-02 · Updated 2021-07-21 · CVE-2020-24397

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Desktop Central version 10.0.0.SP-534

Description An issue in the client side of the software allows an attacker-controlled server to trigger an integer overflow in InternetSendRequestEx and InternetSendRequestByBitrate functions, leading to a heap-based buffer overflow and Remote Code Execution with SYSTEM privileges.

Recommendations For Zoho ManageEngine Desktop Central version 10.0.0.SP-534, consider disabling the InternetSendRequestEx and InternetSendRequestByBitrate functions as a temporary workaround until a patch is available. Restrict access to the client side of the software to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Integer Overflow

Memory Corruption

Weakness Enumeration

CWE-190

CWE-787

Related Identifiers

CVE-2020-24397

Affected Products

Zoho Manageengine Desktop Central

References · 4

• https://manageengine.com/products/desktop-central/integer-overflow-vulnerability.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-24397 · Security Note
• https://osv.dev/vulnerability/CVE-2020-24397 · Vendor Advisory
• https://manageengine.com/products/desktop-central · Vendor Advisory