PT-2020-20315 · Microsoft+1 · Windows+1

Published 2020-03-23 · Updated 2022-10-07 · CVE-2020-8838

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:A/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine AssetExplorer version 6.5

Description An issue was discovered in Zoho ManageEngine AssetExplorer during an upgrade of the Windows agent, where it does not validate the source and binary downloaded. This allows an attacker on an adjacent network to execute code with NT AUTHORITY/SYSTEM privileges on the agent machines by providing an arbitrary executable via a man-in-the-middle attack.

Recommendations For Zoho ManageEngine AssetExplorer version 6.5, as a temporary workaround, consider restricting network access to the Windows agent until a patch is available. Additionally, ensure that the upgrade process is conducted over a secure and trusted network connection to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-354

Related Identifiers

CVE-2020-8838

Affected Products

Windows

Zoho Manageengine Assetexplorer

References · 6

• 🔥 http://packetstormsecurity.com/files/157612/ManageEngine-Asset-Explorer-Windows-Agent-Remote-Code-Execution.html · Exploit
• 🔥 http://seclists.org/fulldisclosure/2020/May/29 · Exploit
• https://osv.dev/vulnerability/CVE-2020-8838 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-8838 · Security Note
• https://manageengine.com/products/asset-explorer/sp-readme.html · Vendor Advisory
• https://t.me/cvenotify/2024 · Telegram Post