CVEs / CVE-2022-28810
CVE-2022-28810: Zoho ManageEngine ADSelfService Plus Remote Code Execution Vulnerability
- Known exploited in the CISA KEV catalog since 7 Mar 2023
- medium 6.8 CVSS 3.1 (NVD)
- EPSS 70.9% chance of exploitation in the next 30 days, higher than 99% of CVEs (30 Oct 2026)
- Last changed at its sources
Are you affected? Check your servers with Stackurity: it lists the software on each server and the vulnerabilities to fix first.
Check your servers with Stackurity Already using Stackurity? Search for CVE-2022-28810
Summary
Zoho ManageEngine ADSelfService Plus contains an unspecified vulnerability allowing for remote code execution when performing a password change or reset.
Description
Zoho ManageEngine ADSelfService Plus before build 6122 allows a remote authenticated administrator to execute arbitrary operating OS commands as SYSTEM via the policy custom script feature. Due to the use of a default administrator password, attackers may be able to abuse this functionality with minimal effort. Additionally, a remote and partially authenticated attacker may be able to inject arbitrary commands into the custom script due to an unsanitized password field.
Affected and fixed versions
| Product | Affected | Fixed in |
|---|---|---|
| n/a n/a | n/a | — |
Exploitation
| In CISA KEV since | 7 Mar 2023 |
|---|---|
| Due date for US federal agencies | 28 Mar 2023 |
| Used in ransomware campaigns | Unknown |
| Required action | Apply updates per vendor instructions. |
Severity
| CVSS 3.1 | 6.8 mediumCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:HScored by NVD |
|---|---|
| Weakness | CWE-78, CWE-798 |
References
- CVE-2022-28810 on NVD
- CVE-2022-28810 in the CISA KEV catalog
- https://www.manageengine.com/products/self-service-password/advisory/CVE-2022-28810.html (cited by CISA)
- http://packetstormsecurity.com/files/166816/ManageEngine-ADSelfService-Plus-Custom-Script-Execution.html Exploit, Third Party Advisory, VDB Entry
- https://github.com/rapid7/metasploit-framework/pull/16475 Exploit, Patch, Third Party Advisory
- https://www.manageengine.com/products/self-service-password/kb/cve-2022-28810.html Patch, Vendor Advisory
- https://www.rapid7.com/blog/post/2022/04/14/cve-2022-28810-manageengine-adselfservice-plus-authenticated-command-execution-fixed/ Exploit, Patch, Technical Description, Third Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-28810 US Government Resource
Sources
Exploitation status from the CISA Known Exploited Vulnerabilities catalog. EPSS scores from FIRST. Descriptions, severity and references from the National Vulnerability Database. Open-source package versions from OSV (CC-BY 4.0). Text is shown as each source states it; Stackurity does not edit it. Check the vendor's advisory before acting.
This product uses data from the NVD API but is not endorsed or certified by the NVD.