dbcve.org
Manageengine Desktop CentralApplication · Zohocorp

CVE-2020-15588

CRITICAL · 9.8 CVSS v3.1 Published 2020-07-29
Fix available
A fix is available. Upgrade to 10.0.561 or later.
See remediation →
100/100
Remediation priority · Urgent
Remotely reachable No privileges Zero-click

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
An issue was discovered in the client side of Zoho ManageEngine Desktop Central 10.0.552.W. An attacker-controlled server can trigger an integer overflow in InternetSendRequestEx and InternetSendRequestByBitrate that leads to a heap-based buffer overflow and Remote Code Execution with SYSTEM privileges. This issue will occur only when untrusted communication is initiated with server. In cloud, Agent will always connect with trusted communication.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · high confidence

Zoho ManageEngine Desktop Central 10.0.552.W contains an integer overflow vulnerability in the InternetSendRequestEx and InternetSendRequestByBitrate functions. When an agent connects to an attacker-controlled server, this integer overflow triggers a heap-based buffer overflow, enabling remote code execution with SYSTEM privileges.

MitigationEnsure agents only communicate with trusted servers; in cloud deployments this is enforced by default. For on-premise installations, apply the vendor patch to a version beyond 10.0.552.W and restrict agent connections to authorized management servers.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.

NVD · CPE data
Manageengine Desktop CentralApplication
Affected:< 10.0.561

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Verify Desktop Central is installed
    Check for Desktop Central installation directory (commonly C:\ManageEngine\DesktopCentral or /opt/DesktopCentral) or look for the Desktop Central service in Windows Services
    Affected if Desktop Central is not installed on the system
  2. Identify installed version number
    Check the version file in the installation directory, or right-click the Desktop Central tray icon and select 'About', or access the admin console and check the version info in the login page footer
    Affected if Version displayed is below 10.0.561 or shows 10.0.552.W specifically
  3. Confirm build number
    Look for build number in the admin console under 'Admin' > 'About' or in the startup logs. Vulnerable builds are those less than 561
    Affected if Build number is less than 561 (e.g., 10.0.552.W indicates build 552)
  4. Verify agent communication configuration
    In the admin console, navigate to 'Agent' > 'Agent Settings' and check the 'Management Server' configuration to confirm agents are configured to communicate only with the legitimate server
    Affected if Agents are configured to allow connections to arbitrary/untrusted servers or the management server URL points to an unrecognized host

The system is affected if Zoho ManageEngine Desktop Central is installed with a version lower than 10.0.561 (build < 561) and agents can connect to untrusted servers.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

dbcve · scoped
Upgrade available Upgrade to 10.0.561 or later
Fixed in 10.0.561
Interim mitigation

Ensure agents only communicate with trusted servers; in cloud deployments this is enforced by default. For on-premise installations, apply the vendor patch to a version beyond 10.0.552.W and restrict agent connections to authorized management servers.

Recommended fix High confidence

ManageEngine Desktop Central 10.0.561 or later

  1. 1. Verify current version of Zoho ManageEngine Desktop Central by checking the About or Version information in the admin console
  2. 2. If version is below 10.0.561, plan for upgrade during a maintenance window
  3. 3. Backup the current installation including database and configuration files
  4. 4. Download the latest version of ManageEngine Desktop Central from the official vendor website (www.manageengine.com)
  5. 5. Stop the Desktop Central server services before upgrading
  6. 6. Install version 10.0.561 or later following vendor upgrade documentation
  7. 7. Verify the upgrade was successful by checking the version number
  8. 8. Start the Desktop Central services
Caveat Standard minor version upgrade - review release notes for any configuration or feature changes

Generated from the published advisory — verify against the referenced sources before acting.

Fix this in Manageengine Desktop Central Scoped from the published advisory
  • Consultation4.0 h
  • Implementation2.0 h
  • Testing6.0 h
  • Review / QA2.0 h
14.0 hours of engineering $2,420
Get the upgrade done

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $3,872.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2020-15588 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2020-15588 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data