CISA KEV · Known exploitedMedium

CVE-2022-28810

Zoho ManageEngine

Zoho ManageEngine ADSelfService Plus before build 6122 allows a remote authenticated administrator to execute arbitrary operating OS commands as SYSTEM via the policy custom script feature. Due to the use of a default administrator password, attackers may be able to abuse this functionality with minimal effort. Additionally, a remote and partially authenticated attacker may be able to inject arbitrary commands into the custom script due to an unsanitized password field.

CVSS: 6.8
EPSS: 71.0%
CISA KEV: Listed
Published: 2022.04.18

PRIORITY ASSESSMENT

Immediate review

CISA has listed this vulnerability in the Known Exploited Vulnerabilities catalog.

Known exploitationConfirmed by CISA KEV

Exploit probability71.0%

Technical severityCVSS 6.8

Vulnerability overview

Affected product and versions

Product: Zoho ManageEngine
Affected versions: < 6.1, 6.1
Fixed versions: 6.1

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide

CISA required action

Apply updates per vendor instructions.

Due date: 2023.03.28

1
Identify
Confirm that Zoho ManageEngine and an affected version are present.
2
Prioritize
Combine exploitation signals with asset exposure and business criticality.
3
Remediate
Follow the vendor advisory or supported update path and preserve rollback options.
4
Verify
Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
CWE: CWE-259, CWE-78, CWE-798
KEV added: 2023.03.07
Ransomware use: 미확인