CVE-2020-15589
mediumpriority · track · 35EPSS 0.083 · 95 %ileEUUSEPSS · scored 2026-10-27
A design issue was discovered in GetInternetRequestHandle, InternetSendRequestEx and InternetSendRequestByBitrate in the client side of Zoho ManageEngine Desktop Central 10.0.552.W and Remote Access Plus before 10.1.2119.1. By exploiting this issue, an attacker-controlled server can force the client to skip TLS certificate validation, leading to a man-in-the-middle attack against HTTPS and unauthenticated remote code execution.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.8–8.1
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (3)
Products and version ranges known to be affected.
- zohocorp manageengine desktop central= 10.0.552.wnvdUScpe:2.3:a:zohocorp:manageengine_desktop_central:*:*:*:*:*:*:*:*
- zohocorp manageengine remote access plus< 10.1.2119.1nvdUScpe:2.3:a:zohocorp:manageengine_remote_access_plus:*:*:*:*:*:*:*:*
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (7)
External citations — patches, advisories, analysis.
- https://nvd.nist.gov/vuln/detail/CVE-2020-15589cnnvd
- https://www.manageengine.com/products/desktop-central/cnnvd
- https://www.manageengine.com/products/desktop-central/untrusted-agent-server-communication.htmlcnnvd
- https://www.manageengine.com/products/desktop-central/enisa_euvd
- https://www.manageengine.com/products/desktop-central/untrusted-agent-server-communication.htmlenisa_euvd
- https://www.manageengine.com/products/desktop-central/ProductVendor Advisorynvd
- https://www.manageengine.com/products/desktop-central/untrusted-agent-server-communication.htmlVendor Advisorynvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan