CVE-2022-28810
Zoho ManageEngine ADSelfService Plus Remote Code Execution Vulnerability
Description
CVE-2022-28810 is a command injection vulnerability in Zoho ManageEngine ADSelfService Plus before build 6122 that allows a remote authenticated administrator to execute arbitrary operating system commands as SYSTEM. The flaw exists in the policy custom script feature, where unsanitized input enables OS command injection. Compounding the risk, ManageEngine ADSelfService Plus uses a default administrator password, meaning attackers may exploit this vulnerability with minimal effort. With an EPSS score of 91.9% (99.7th percentile) and confirmed active exploitation, CVE-2022-28810 also involves hard-coded credentials (CWE-798), making it a serious security concern for organizations using this identity management product.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| zohocorp | manageengine adselfservice plus | < 6.1; 6.1 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/166816/ManageEngine-ADSelfService-Plus-Custom-Script-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- https://github.com/rapid7/metasploit-framework/pull/16475(Exploit, Patch, Third Party Advisory)
- https://www.manageengine.com/products/self-service-password/kb/cve-2022-28810.html(Patch, Vendor Advisory)
- https://www.rapid7.com/blog/post/2022/04/14/cve-2022-28810-manageengine-adselfservice-plus-authenticated-command-execution-fixed/(Exploit, Patch, Technical Description, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-28810(US Government Resource)
Weakness Type
CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CWE-78 occurs when an application constructs operating system commands using externally influenced input without properly neutralizing special elements. In CVE-2022-28810, ManageEngine ADSelfService Plus builds shell commands incorporating user-supplied input from the custom script policy feature and an unsanitized password field, allowing an attacker to inject arbitrary OS commands that execute as SYSTEM.
Learn more: CWE-78 — OS Command Injection
CWE-798: Use of Hard-coded Credentials
CWE-798 describes a weakness where software contains hard-coded credentials such as passwords, cryptographic keys, or other authentication secrets. In ManageEngine ADSelfService Plus, the use of a default administrator password significantly lowers the barrier to exploitation of CVE-2022-28810, allowing attackers to gain the required administrator access without needing to compromise credentials through other means.
Learn more: CWE-798 — Use of Hard-coded Credentials
Impact Analysis
CVE-2022-28810 carries a CVSS v3.1 score of 6.8 (Medium severity), though the real-world risk is amplified by the presence of default credentials and public exploit code. Attack Vector (Network): The vulnerability is exploitable remotely over the network through the ManageEngine ADSelfService Plus web interface. Attack Complexity (Low): No special conditions or preparation are required beyond having administrator access. Privileges Required (High): Administrator-level access is nominally required, but the default administrator password makes this effectively a low barrier in unpatched deployments. User Interaction (Required): Some form of user interaction is needed to trigger the vulnerability. Confidentiality Impact (High): Successful exploitation allows the attacker to read arbitrary data on the system, since commands execute as SYSTEM. Integrity Impact (High): The attacker can modify files, install backdoors, or alter system configurations. Availability Impact (High): The attacker can disrupt services or render the system inoperable. The EPSS score of 91.9% (99.7th percentile) places this vulnerability in the top tier of exploited flaws, and its inclusion in CISA's KEV catalog with a deadline of March 28, 2023, confirms its active exploitation.
Exploit Maturity
Public exploit code is widely available for CVE-2022-28810. A Metasploit module has been submitted via the Rapid7 Metasploit Framework repository, and a detailed exploit is published on Packet Storm Security demonstrating the ManageEngine ADSelfService Plus custom script execution attack. Rapid7 has also published a comprehensive blog post with technical exploitation details and patch information. CISA has confirmed active exploitation by adding CVE-2022-28810 to the Known Exploited Vulnerabilities catalog with a remediation deadline of March 28, 2023. The EPSS score of 91.9% (99.7th percentile) reflects near-certain exploitation activity, driven by the combination of public exploits and the default administrator password that simplifies initial access.
Remediation
- Update ManageEngine ADSelfService Plus to build 6122 or later immediately. The KEV required action states: apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Zoho has released a patch that addresses both the command injection and the default credential issues.
- Change the default administrator password immediately. Even before applying the patch, change the default administrator credentials to a strong, unique password to prevent attackers from leveraging CWE-798 for initial access.
- Restrict network access to the ManageEngine ADSelfService Plus administration interface. Use firewall rules and network segmentation to limit access to trusted administrator IP addresses only.
- Audit custom script policies for malicious modifications. Review all existing custom script configurations in ADSelfService Plus policies for any unauthorized commands or scripts that may have been injected through this vulnerability.
- Monitor for indicators of compromise. Check system logs for unexpected SYSTEM-level command execution, unusual process creation, or unauthorized changes to custom script policies that could indicate prior exploitation of CVE-2022-28810.
Technical Details
CVE-2022-28810 affects the policy custom script feature in Zoho ManageEngine ADSelfService Plus before build 6122. The vulnerability has two related attack paths. Primary Path (Authenticated Administrator): An administrator can configure custom scripts as part of ADSelfService Plus policies. The application passes user-controlled input directly into operating system commands without proper sanitization, allowing arbitrary command injection. Since the service runs with SYSTEM privileges on Windows, injected commands execute with full administrative authority. Secondary Path (Password Field Injection): A partially authenticated attacker can inject arbitrary commands through an unsanitized password field that is incorporated into the custom script execution flow. This path requires less privilege than full administrator access, broadening the potential attacker pool. Default Credentials (CWE-798): The presence of a default administrator password in ManageEngine ADSelfService Plus means that many installations remain accessible with known credentials, effectively negating the "high privileges required" constraint in the CVSS score. The combination of default credentials and command injection creates a straightforward attack chain: authenticate with the default password, then inject OS commands via the custom script feature or password field.
Frequently Asked Questions
Is CVE-2022-28810 being actively exploited?
Yes, CVE-2022-28810 has been actively exploited in the wild. CISA added it to the Known Exploited Vulnerabilities catalog with a remediation deadline of March 28, 2023. Public exploit code is available through Metasploit and Packet Storm Security, and the EPSS score of 91.9% confirms widespread exploitation activity.
What products are affected by CVE-2022-28810?
CVE-2022-28810 affects Zoho ManageEngine ADSelfService Plus builds prior to 6122. ADSelfService Plus is an identity management and self-service password reset tool commonly used in enterprise environments. Organizations running older builds of this product should update immediately.
How do I fix CVE-2022-28810?
Update ManageEngine ADSelfService Plus to build 6122 or later, and immediately change the default administrator password. Additionally, restrict network access to the administration interface and audit existing custom script policies for any signs of tampering. See the Remediation section for detailed steps.
How severe is CVE-2022-28810?
CVE-2022-28810 is rated Medium severity with a CVSS v3.1 score of 6.8. However, the real-world risk is significantly higher due to the default administrator password (CWE-798) that effectively lowers the exploitation barrier. The EPSS score of 91.9% (99.7th percentile) indicates near-certain exploitation, making immediate patching essential.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.