PT-2020-2203 · Zoho · Zoho Manageengine Desktop Central

Steven Seeley · Published 2020-03-06 · Updated 2026-04-06 · CVE-2020-10189

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Desktop Central versions prior to 10.0.474

Description The issue is related to the deserialization of untrusted data in the getChartImage method of the FileStorage class, which is associated with the CewolfServlet and MDMLogUploaderServlet servlets. This allows for remote code execution.

Recommendations For versions prior to 10.0.474, update to version 10.0.474 or later to resolve the issue. As a temporary workaround, consider restricting access to the CewolfServlet and MDMLogUploaderServlet servlets until a patch is applied. Additionally, avoid using the getChartImage method in the FileStorage class until the issue is resolved.

Exploit

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

BDU:2020-02110

CVE-2020-10189

Affected Products

Zoho Manageengine Desktop Central

References · 23

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/desktopcentral_deserialization.rb · Exploit
• 🔥 http://packetstormsecurity.com/files/156730/ManageEngine-Desktop-Central-Java-Deserialization.html · Exploit
• 🔥 https://srcincite.io/advisories/src-2020-0011 · Exploit
• 🔥 https://srcincite.io/pocs/src-2020-0011.py.txt · Exploit
• 🔥 https://exploit-db.com/exploits/48224 · Exploit
• https://osv.dev/vulnerability/CVE-2020-10189 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-10189 · Security Note
• https://bdu.fstec.ru/vul/2020-02110 · Security Note
• https://manageengine.com/products/desktop-central/remote-code-execution-vulnerability.html · Vendor Advisory
• https://xakep.ru/2020/04/24/web-shells · Note
• https://cwe.mitre.org/data/definitions/502.html · Note
• https://twitter.com/DeusLogica/status/2040990750888849662 · Twitter Post
• https://t.me/true_secator/3125 · Telegram Post
• https://t.me/aptreports/26549 · Telegram Post
• https://t.me/malwr/3927 · Telegram Post