Detections
Analytics
CVE-2022-28810
medium
Description
Zoho ManageEngine ADSelfService Plus before build 6122 allows a remote authenticated administrator to execute arbitrary operating OS commands as SYSTEM via the policy custom script feature. Due to the use of a default administrator password, attackers may be able to abuse this functionality with minimal effort. Additionally, a remote and partially authenticated attacker may be able to inject arbitrary commands into the custom script due to an unsanitized password field.
References
https://www.mandiant.com/resources/blog/zero-days-exploited-2022
https://www.manageengine.com/products/self-service-password/kb/cve-2022-28810.html