Actively exploited · Published Apr 18, 2022 · Assigned by mitre
CVE-2022-28810
Medium 6.8 Exploited
In plain English
A medium-severity hard-coded credentials in ManageEngine from Zoho. Attackers are actively exploiting it in the wild (listed by CISA on March 7, 2023). The chance it is exploited in the next 30 days is estimated at 71.0% (higher than 99.4% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit. Apply updates per vendor instructions.
CISA guidance
Apply updates per vendor instructions.
Federal agencies must remediate by Mar 28, 2023.
Official description
Zoho ManageEngine ADSelfService Plus before build 6122 allows a remote authenticated administrator to execute arbitrary operating OS commands as SYSTEM via the policy custom script feature. Due to the use of a default administrator password, attackers may be able to abuse this functionality with minimal effort. Additionally, a remote and partially authenticated attacker may be able to inject arbitrary commands into the custom script due to an unsanitized password field.
Affected products (as reported)
Weakness: CWE-798 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
References
- https://www.manageengine.com/products/self-service-password/kb/cve-2022-28810.html x_refsource_MISC
- http://packetstormsecurity.com/files/166816/ManageEngine-ADSelfService-Plus-Custom-Script-Execution.html x_refsource_MISC
- https://github.com/rapid7/metasploit-framework/pull/16475 x_refsource_MISC
- https://www.rapid7.com/blog/post/2022/04/14/cve-2022-28810-manageengine-adselfservice-plus-authenticated-command-execution-fixed/ x_refsource_MISC
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-28810 government-resource