CVE-2020-10189 kev in the critical feed json
Zoho ManageEngine Desktop Central before 10.0.474 allows remote code execution because of deserialization of untrusted data in getChartImag…
published 2020-03-06 6 y ago modified 2026-06-17 4 mo ago also EUVD-2020-2650
- cvss
- 9.8
- version 3.0, CNA
- cisa kev
- Exploited
- added 2021-11-03
- epss
- 99.9%
- EPSS 99.9% chance of exploitation in 30 days, percentile 99.9%
- public exploits
- 2
- Metasploit, Exploit-DB, plus a Nuclei check
Summary
Zoho ManageEngine Desktop Central before 10.0.474 allows remote code execution because of deserialization of untrusted data in getChartImage in the FileStorage class. This is related to the CewolfServlet and MDMLogUploaderServlet servlets.
Patch / fix
cisa required action Apply updates per vendor instructions.
- zohocorp manageengine_desktop_central 10.0.479
Timeline
- First public exploit (Metasploit exploit/windows/http/desktopcentral_deserialization)
- Published
- Added to CISA KEV
- CISA patch deadline
- CISA SSVC: exploitation active
Known exploited
- Added
- 5 y ago
- Patch by
- 2022-05-03 (4 y ago)
- Ransomware
- Not known
- Required action
- Apply updates per vendor instructions.
- Vendor, product
- Zoho, ManageEngine
- CISA name
- Zoho ManageEngine Desktop Central File Upload Vulnerability
CISA SSVC
- Exploitation
- Active, exploited in the wild
- Automatable
- yes
- Technical impact
- total
- Assessed
- 21 mo ago
Exploit prediction
99.94% chance of exploitation in the next 30 days, higher than 99.9% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- Metasploit exploit/windows/http/desktopcentral_deserialization ManageEngine Desktop Central Java Deserialization metasploit exploit, great rank, 2020-03-05
- EDB-48224 ManageEngine Desktop Central - Java Deserialization (Metasploit) remote, 2020-03-17
- Nuclei template ManageEngine Desktop Central Java Deserialization nuclei detection template
- srcincite.io https://srcincite.io/advisories/src-2020-0011/ referenced PoC, tagged "exploit" by a source, unverified
- srcincite.io https://srcincite.io/pocs/src-2020-0011.py.txt referenced PoC, tagged "exploit" by a source, unverified
- packetstormsecurity.com http://packetstormsecurity.com/files/156730/ManageEngine-Desktop-Central-Java-Deserialization.html referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.0 | 9.8 | CVSS:3.0/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:N |
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| CNA | 3.0 | 9.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 10.0 | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Classification
- Weakness
-
- CWE-502 Deserialization of Untrusted Data
References
-
srcincite.io
/advisories/src-2020-0011/
exploit, third-party-advisory
-
srcincite.io
/pocs/src-2020-0011.py.txt
exploit, third-party-advisory
-
packetstormsecurity.com
/files/156730/ManageEngine-Desktop-Central-Java-Deserialization.html
exploit, third-party-advisory, vdb-entry
-
manageengine.com
/products/desktop-central/remote-code-execution-vulnerability.html
vendor-advisory
-
zdnet.com
/article/zoho-zero-day-published-on-twitter/
third-party-advisory
-
cwe.mitre.org
/data/definitions/502.html
third-party-advisory
-
cisa.gov
/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-10189
government-resource, us-government-resource
Sources
- CVE List CVE-2020-10189
- NVD CVE-2020-10189
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.