// For flags

CVE-2020-15588

 

Severity Score

9.8
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

An issue was discovered in the client side of Zoho ManageEngine Desktop Central 10.0.552.W. An attacker-controlled server can trigger an integer overflow in InternetSendRequestEx and InternetSendRequestByBitrate that leads to a heap-based buffer overflow and Remote Code Execution with SYSTEM privileges. This issue will occur only when untrusted communication is initiated with server. In cloud, Agent will always connect with trusted communication.

Se detectó un problema en el lado del cliente de Zoho ManageEngine Desktop Central versión 10.0.552.W. Un servidor controlado por un atacante puede desencadenar un desbordamiento de enteros en InternetSendRequestEx e InternetSendRequestByBitrate que conduce a un desbordamiento de búfer basado en la pila y a la ejecución remota de código con privilegios de SYSTEM. Este problema sólo se produce cuando se inicia una comunicación no fiable con el servidor. En la nube, el Agente siempre se conectará con una comunicación de confianza

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
Partial
Integrity
Partial
Availability
Partial
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2020-07-07 CVE Reserved
  • 2020-07-29 CVE Published
  • 2024-08-04 CVE Updated
  • 2024-09-07 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-190: Integer Overflow or Wraparound
  • CWE-787: Out-of-bounds Write
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Zohocorp
Search vendor "Zohocorp"
 Manageengine Desktop Central
Search vendor "Zohocorp" for product "Manageengine Desktop Central"
 < 10.0.561
Search vendor "Zohocorp" for product "Manageengine Desktop Central" and version " < 10.0.561"
-
Affected