Zoho ManageEngine Desktop Central 未授权访问漏洞

Description

PoC

None yet. Search at https://trap.biu.life/?ref=rss

References

• https://www.manageengine.com/products/desktop-central/remote-code-execution-vulnerability.html
• https://www.sentinelone.com/vulnerability-database/cve-2020-10189/
• https://threatprotect.qualys.com/2020/03/11/manageengine-desktop-central-unauthenticated-remote-code-execution-vulnerability-cve-2020-10189/
• https://nvd.nist.gov/vuln/detail/cve-2020-10189
• https://www.rapid7.com/db/vulnerabilities/http-manageengine-dc-cve-2020-10189/
• https://www.broadcom.com/support/security-center/attacksignatures/detail?asid=32109
• https://www.manageengine.com/products/desktop-central/cve-2021-44757.html
• https://www.cisa.gov/news-events/alerts/2022/01/19/zoho-releases-security-advisory-manageengine-desktop-central-and-desktop-central-msp
• https://it.ucsf.edu/actively-exploited-critical-vulnerability-zoho-manageengine-desktop-and-desktop-central
• https://www.manageengine.com/products/desktop-central/privilege-escalation-endpointcentral-agent.html
• https://nvd.nist.gov/vuln/detail/CVE-2024-10203
• https://www.manageengine.com/products/desktop-central/cve-2021-46165.html
• https://labs.jumpsec.com/zoho-manageengine-desktop-central-path-traversal-arbitrary-file-write/
• https://www.manageengine.com/desktop-management-msp/cve-2021-44515-security-advisory.html
• https://www.secpod.com/blog/zoho-patches-a-critical-vulnerability-in-its-manageengine-desktop-central-solutions
• https://nvd.nist.gov/vuln/detail/cve-2022-47966

Related Vulnerabilities

• PoCCVE-2026-86206: N-able N-central - Access Control Bypass via Path Confusion and Forwarded Header Spoofing
• PoCCVE-2026-86207: N-able N-central - Authentication Bypass
• 旭辰資訊｜SmartIT Desktop Manager - 存在4個漏洞
• PoCCVE-2026-18577: N-able N-central < 2026.3.1.10 - Authentication Bypass
• PoCCVE-2019-1003030: Jenkins Pipeline Groovy Plugin <=2.63 - Insecure Deserialization
• PoCCVE-2026-3001: Gutenverse Plugin <= 3.4.6 - Cross-Site Scripting
• PoCCVE-2025-6389: Sneeit WP Social WordPress Plugin - Unauthenticated RCE via call_user_func
• PoCCVE-2026-3296: Everest Forms WordPress Plugin <= 3.4.3 - PHP Object Injection
• PoCNginxWebUI /adminPage/login/getAuth 命令执行漏洞
• PoCNginxWebUI /Adminpage/Conf/loadOrg 文件读取漏洞
• NginxWebUI /Api/Nginx/runNginxCmd 命令执行漏洞
• NginxWebUI /Adminpage/Remote/cmdOver 命令执行漏洞
• Stripe Payment Plugin for WooCommerce /wc-api/WT_Stripe/ SQL 注入漏洞（CVE-2024-0705）