CVE-2020-24397 - An issue was discovered in the client side of Zoho ManageEngine Desktop Central 10.0.0.SP-534

Back Back to CVE browser

HIGH

An issue was discovered in the client side of Zoho ManageEngine Desktop Central 10.0.0.SP-534

Published Oct 2, 2020

7.2

HIGH

CVSS 3.1

EPSS 15.42%

Description

An issue was discovered in the client side of Zoho ManageEngine Desktop Central 10.0.0.SP-534. An attacker-controlled server can trigger an integer overflow in InternetSendRequestEx and InternetSendRequestByBitrate that leads to a heap-based buffer overflow and Remote Code Execution with SYSTEM privileges.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-190

Integer Overflow

CWE-787

Out-of-bounds Write

References (2)

https://www.manageengine.com/products/desktop-central/
x_refsource_MISCProductVendor Advisory
https://www.manageengine.com/products/desktop-central/integer-overflow-vulnerability.html
x_refsource_CONFIRMVendor Advisory

Link	Providers	Tags
https://www.manageengine.com/products/desktop-central/		x_refsource_MISCProductVendor Advisory
https://www.manageengine.com/products/desktop-central/integer-overflow-vulnerability.html		x_refsource_CONFIRMVendor Advisory