Memory Leak Vulnerability in Manage Engine Asset Explorer Agent

CVE-2021-20108

What is CVE-2021-20108?

Manage Engine Asset Explorer Agent version 1.0.34 is susceptible to a memory leak caused by unverified HTTPS certificate handling on port 9000. This vulnerability allows an attacker on the network to send commands that, while not directly executed due to authtoken validation, lead to repeated memory allocations that are never freed. Specifically, the commands sent to the agent result in both the allocation of memory for operation commands and conversion of these commands into Unicode strings, which also remain unreleased. This creates an opportunity for a remote attacker to exploit the vulnerability, potentially leading to a Denial of Service condition, as the agent may exhaust its available memory resources and crash.

References