CVE-2020-15589
CVE-2020-15589
Vexday Risk Score
3Low
SSVC decision (CISA)
Track
No exploitation signal → monitor
CVSS —EPSS 8.3%KEV nãoPoC —Nuclei —Metasploit —Patch —
Lifecycle
02 Oct 2020Published on NVD
Recommendation: Monitor — no exploitation signal at the moment.
A design issue was discovered in GetInternetRequestHandle, InternetSendRequestEx and InternetSendRequestByBitrate in the client side of Zoho ManageEngine Desktop Central 10.0.552.W and Remote Access Plus before 10.1.2119.1. By exploiting this issue, an attacker-controlled server can force the client to skip TLS certificate validation, leading to a man-in-the-middle attack against HTTPS and unauthenticated remote code execution.
Affected products
n/a · n/aWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →