PT-2021-11573 · Zoho · Zoho Manageengine Opmanager

Published 2021-02-03 · Updated 2025-10-07 · CVE-2020-28653

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine OpManager versions prior to 125203 (Stable build) and prior to 125233 (Released build)

Description: The issue allows Remote Code Execution via the Smart Update Manager (SUM) servlet. This can be exploited for malicious purposes.

Recommendations: For versions prior to 125203 (Stable build) and prior to 125233 (Released build), update to a version that is 125203 or later for Stable builds, and 125233 or later for Released builds. As a temporary workaround, consider disabling the Smart Update Manager (SUM) servlet until a patch is available. Restrict access to the SUM servlet to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2020-28653

Affected Products

Zoho Manageengine Opmanager

References · 12

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/opmanager_sumpdu_deserialization.rb · Exploit
• 🔥 http://packetstormsecurity.com/files/164231/ManageEngine-OpManager-SumPDU-Java-Deserialization.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-28653 · Security Note
• https://osv.dev/vulnerability/CVE-2020-28653 · Vendor Advisory
• https://manageengine.com/network-monitoring/help/read-me-complete.html#125233 · Vendor Advisory
• https://manageengine.com/network-monitoring/help/read-me-complete.html#125203 · Vendor Advisory
• https://t.me/secharvester/11285 · Telegram Post
• https://t.me/defcon_news/81762 · Telegram Post
• https://t.me/cibsecurity/23028 · Telegram Post
• https://t.me/rnetsec/15380 · Telegram Post
• https://twitter.com/pdnuclei_bot/status/1975425897298624629 · Twitter Post
• https://t.me/cvenotify/9337 · Telegram Post