CVE-2020-15589
A design issue was discovered in GetInternetRequestHandle, InternetSendRequestEx and InternetSendRequestByBitrate in the client side of Zoho ManageEngine Desktop Central 10.0.552.W and Remote Access Plus before 10.1.2119.1.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (8.29%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
A design issue was discovered in GetInternetRequestHandle, InternetSendRequestEx and InternetSendRequestByBitrate in the client side of Zoho ManageEngine Desktop Central 10.0.552.W and Remote Access Plus before 10.1.2119.1. By exploiting this issue, an attacker-controlled server can force the client to skip TLS certificate validation, leading to a man-in-the-middle attack against HTTPS and unauthenticated remote code execution.
- CVSS 3.1
- 8.1 HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 8.29% probability · 95th percentile
- CISA KEV
- Not listed
- Affected
- zohocorp/manageengine desktop central · zohocorp/manageengine remote access plus
- Source
- cve@mitre.org
References
- https://www.manageengine.com/products/desktop-central/Product, Vendor Advisory
- https://www.manageengine.com/products/desktop-central/untrusted-agent-server-communication.htmlVendor Advisory
- https://www.manageengine.com/products/desktop-central/Product, Vendor Advisory
- https://www.manageengine.com/products/desktop-central/untrusted-agent-server-communication.htmlVendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.