Vulnerability · Published Jul 19, 2021 · Assigned by tenable

CVE-2021-20109

High 7.5

In plain English

A high-severity security flaw in Manage Engine Asset Explorer Agent. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.4% (higher than 72% of all known vulnerabilities).

Severity (CVSS NVD)7.5High

Exploit odds (30 days)1.4%top 27.8% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Due to the Asset Explorer agent not validating HTTPS certificates, an attacker on the network can statically configure their IP address to match the Asset Explorer's Server IP address. This will allow an attacker to send a NEWSCAN request to a listening agent on the network as well as receive the agent's HTTP request verifying its authtoken. In AEAgent.cpp, the agent responding back over HTTP is vulnerable to a Heap Overflow if the POST payload response is too large. The POST payload response is converted to Unicode using vswprintf. This is written to a buffer only 0x2000 bytes big. If POST payload is larger, then heap overflow will occur.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Ubuntu:22.04:LTS	due	no fix listed	UBUNTU-CVE-2021-20109
Ubuntu:24.04:LTS	due	no fix listed	UBUNTU-CVE-2021-20109
Ubuntu:25.10	due	no fix listed	UBUNTU-CVE-2021-20109
Ubuntu:26.04:LTS	due	no fix listed	UBUNTU-CVE-2021-20109
Ubuntu:26.10	due	no fix listed	UBUNTU-CVE-2021-20109

Affected products (as reported)

Vendor	Product	Versions
n/a	Manage Engine Asset Explorer Agent	1.0.34

References

https://www.tenable.com/security/research/tra-2021-30 x_refsource_MISC