Heap-based Buffer Overflow in Zoho ManageEngine Desktop Central
CVE-2020-24397

7.2HIGH

Key Information:

Vendor

Zohocorp
Status
Manageengine Desktop Central
Vendor
CVE Published:
2 October 2020

What is CVE-2020-24397?

An integer overflow vulnerability was identified in the client side of Zoho ManageEngine Desktop Central, specifically in version 10.0.0.SP-534. This flaw allows an attacker to control a server that can exploit this vulnerability by triggering integer overflow conditions in the InternetSendRequestEx and InternetSendRequestByBitrate functions. Consequently, this may lead to a heap-based buffer overflow, which can enable remote code execution with SYSTEM privileges, granting unauthorized access to the affected system.

References

https://www.manageengine.com/products/desktop-central/
x_refsource_MISC
https://www.manageengine.com/products/desktop-central/int...
x_refsource_CONFIRM

EPSS Score

12% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.