CVE-2020-10189
Zoho ManageEngine Desktop Central File Upload Vulnerability
Description
CVE-2020-10189 is a critical deserialization of untrusted data vulnerability in Zoho ManageEngine Desktop Central, an enterprise endpoint management and mobile device management platform. The vulnerability exists in the getChartImage method of the FileStorage class within versions prior to 10.0.474, and is related to the CewolfServlet and MDMLogUploaderServlet servlets. An unauthenticated remote attacker can exploit CVE-2020-10189 to achieve arbitrary code execution on the affected server. CISA has added this vulnerability to its Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. With an EPSS score of 94.25% (99.93rd percentile), this Zoho ManageEngine Desktop Central vulnerability poses an extreme risk to organizations running unpatched instances.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| zohocorp | manageengine desktop central | < 10.0.479 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/156730/ManageEngine-Desktop-Central-Java-Deserialization.html(Exploit, Third Party Advisory, VDB Entry)
- https://cwe.mitre.org/data/definitions/502.html(Third Party Advisory)
- https://srcincite.io/advisories/src-2020-0011/(Exploit, Third Party Advisory)
- https://srcincite.io/pocs/src-2020-0011.py.txt(Exploit, Third Party Advisory)
- https://www.manageengine.com/products/desktop-central/remote-code-execution-vulnerability.html(Vendor Advisory)
- https://www.zdnet.com/article/zoho-zero-day-published-on-twitter/(Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-10189(US Government Resource)
Weakness Type
CWE-502: Deserialization of Untrusted Data
CWE-502 occurs when an application deserializes data from untrusted sources without adequate validation, allowing attackers to inject malicious objects into the application. In CVE-2020-10189, the Zoho ManageEngine Desktop Central application deserializes untrusted data in the getChartImage function of the FileStorage class, enabling remote attackers to execute arbitrary code by sending crafted serialized Java objects.
Learn more: CWE-502 — Deserialization of Untrusted Data
Impact Analysis
CVE-2020-10189 carries a CVSS 3.1 score of 9.8 (CRITICAL), reflecting the maximum exploitability and severe impact. The vulnerability is remotely exploitable over the network with low attack complexity, requires no authentication and no user interaction, making it trivially exploitable by any attacker who can reach the ManageEngine Desktop Central web interface. Successful exploitation results in complete compromise of confidentiality, integrity, and availability, granting the attacker full control over the endpoint management server and potentially all managed endpoints. The EPSS score of 94.25% (99.93rd percentile) indicates near-certain exploitation activity. Given that Desktop Central manages enterprise endpoints and mobile devices, a compromise could cascade to thousands of managed systems, making this vulnerability exceptionally dangerous in enterprise environments.
Exploit Maturity
CVE-2020-10189 has a highly mature exploit landscape with multiple publicly available exploits. CISA has confirmed active exploitation in the wild through its KEV catalog listing. Public exploit code is available via Packet Storm Security, and additional proof-of-concept code has been published by Source Incite. The EPSS score of 94.25% (99.93rd percentile) indicates near-certain exploitation activity, consistent with widespread targeting by threat actors seeking to compromise enterprise endpoint management infrastructure. Federal agencies were required to remediate this vulnerability by 2022-05-03 per CISA binding operational directive.
Remediation
- Apply updates immediately as mandated by CISA KEV: Apply updates per vendor instructions. Upgrade Zoho ManageEngine Desktop Central to version 10.0.479 or later using the official patch from the ManageEngine security advisory.
- Verify that all instances of ManageEngine Desktop Central (versions prior to 10.0.479) have been updated. Check the build number in the Desktop Central admin console to confirm the patched version is running.
- If immediate patching is not possible, restrict network access to the Desktop Central web interface, particularly the CewolfServlet and MDMLogUploaderServlet endpoints. Block external access and limit connectivity to trusted administrative networks only.
- Conduct forensic analysis of affected Desktop Central servers, reviewing application logs for suspicious deserialization activity, checking for unauthorized files or webshells, and scanning for indicators of compromise associated with known exploitation campaigns.
- Implement long-term hardening measures including input validation and deserialization filtering at the application layer, deploying a web application firewall (WAF) to inspect and block malicious serialized payloads, and implementing network segmentation to isolate endpoint management infrastructure from general network traffic.
Technical Details
CVE-2020-10189 exploits an insecure deserialization flaw classified under CWE-502 (Deserialization of Untrusted Data) in Zoho ManageEngine Desktop Central versions prior to 10.0.474. The vulnerability resides in the getChartImage method of the FileStorage class, which processes untrusted serialized Java objects received through the CewolfServlet and MDMLogUploaderServlet servlets without proper validation. An attacker can craft malicious serialized Java objects that, when deserialized by the application, execute arbitrary commands on the underlying operating system. The CVSS vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H confirms that exploitation requires no authentication and is achievable over the network with low complexity, resulting in complete system compromise.
Frequently Asked Questions
Is CVE-2020-10189 being actively exploited?
Yes. CVE-2020-10189 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. Multiple public exploits are available, and the EPSS score of 94.25% (99.93rd percentile) indicates near-certain exploitation activity.
What products are affected by CVE-2020-10189?
CVE-2020-10189 affects Zoho ManageEngine Desktop Central versions prior to 10.0.479. All earlier versions of the endpoint management platform are vulnerable to this deserialization attack through the CewolfServlet and MDMLogUploaderServlet servlets.
How do I fix CVE-2020-10189?
Upgrade Zoho ManageEngine Desktop Central to version 10.0.479 or later by applying the official vendor patch. If immediate patching is not possible, restrict external network access to the Desktop Central web interface and conduct forensic analysis for indicators of compromise.
How severe is CVE-2020-10189?
CVE-2020-10189 has a CVSS 3.1 score of 9.8 (CRITICAL) and an EPSS score in the 99.93rd percentile. It requires no authentication, is remotely exploitable, and grants full system control, making it one of the most dangerous vulnerabilities affecting enterprise endpoint management platforms.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.