peter bassill · operator
$ cve CVE-2022-28810 JSON

CVE-2022-28810 KEV

6.8
MEDIUM · CVSS 3.1 · EPSS 71% (pctl 99)

Patch first

On CISA KEV — known exploited in the wild, due 2023-03-28.

Description

Zoho ManageEngine ADSelfService Plus before build 6122 allows a remote authenticated administrator to execute arbitrary operating OS commands as SYSTEM via the policy custom script feature. Due to the use of a default administrator password, attackers may be able to abuse this functionality with minimal effort. Additionally, a remote and partially authenticated attacker may be able to inject arbitrary commands into the custom script due to an unsanitized password field.

Scoring

CVSS6.8 (MEDIUM, v3.1)
VectorCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
EPSS70.97% — more likely to be exploited than 99% of all CVEs
WeaknessCWE-78
On CISA KEVyes — remediate by 2023-03-28
Public exploitnone known
Published2022-04-18
Last modified2026-06-17

CISA KEV

NameZoho ManageEngine ADSelfService Plus Remote Code Execution Vulnerability
Added2023-03-07
Due2023-03-28
Vendor / productZoho / ManageEngine
Ransomware usenone reported

Affected (1)

VendorProduct
zohocorpmanageengine adselfservice plus

References

→ the Explorer  ·  watch your stack  ·  NVD