CVE DatabaseCVE-2020-10189

Updated 2026-06-17한국어 권고문 →

CVE-2020-101899.8/CRITICALCISA KEVCWE-502CWE-502

Zoho ManageEngine Desktop Central Untrusted Data Deserialization Remote Code Execution (RCE) Vulnerability (CVE-2020-10189)

⚡ Jump to Patch

Affected Vendors

zoho

Affected Components

manageengine desktop central

Published Date

2020-03-06

CVSS v3.1

9.8

CRITICAL

EPSS (30d)

99.9%

FIRST.org

CISA KEV

Exploited

NVD Source ↗

Executive & SecOps Summary

SECOPS ASSESSMENT

Affected Scope

Zoho ManageEngine Desktop Central versions prior to 10.0.474

Impact

Unauthenticated remote attackers can execute arbitrary code with SYSTEM/Administrator privileges by sending specially crafted serialized Java objects

Mitigation

Immediately upgrade to version 10.0.474 or higher, and restrict external access to the management ports

Affected Products & Version Scope

All builds of Zoho ManageEngine Desktop Central prior to 10.0.474

Remediation & Live Workaround Commands

PATCH & WORKAROUND

1. Official Patch & Version Upgrade Commands

The primary remediation is to apply the official service pack to upgrade ManageEngine Desktop Central to version 10.0.474 or later. Below are the commands to stop the service and prepare for the upgrade on a Linux-based installation.

bash

# Stop the ManageEngine Desktop Central service (Linux)
cd /opt/ManageEngine/DesktopCentral_Server/bin
sh shutDown.sh

# Verify the current build version
cat ../conf/system_properties.conf | grep -i 'buildnumber'

2. Temporary Workaround & Hardening Configuration

If patching cannot be applied immediately, restrict access to the Desktop Central web console ports (default 8020, 8383, 8443) using firewalls or security groups. Below is an Nginx reverse proxy configuration snippet to block external access to the vulnerable servlet endpoints.

nginx

# Nginx configuration file (/etc/nginx/conf.d/desktop_central.conf)
server {
    listen 443 ssl;
    server_name desktopcentral.local;

    # Block external access to vulnerable servlet endpoints
    location ~* /(cewolf|MDMLogUploader) {
        allow 192.168.1.0/24; # Allow trusted internal network only
        deny all;
        proxy_pass http://127.0.0.1:8020;
    }

    location / {
        proxy_pass http://127.0.0.1:8020;
    }
}

3. Log Audit & IoC Verification Commands

Inspect the server access logs for suspicious POST requests targeting the vulnerable servlets. The following PowerShell script can be used on Windows servers to search for potential exploitation attempts in the access logs.

powershell

# Search Desktop Central access logs for suspicious servlet requests
$LogPath = 'C:\Program Files\DesktopCentral_Server\logs\access_log*'
Get-ChildItem -Path $LogPath | Get-Content | Where-Object {
    $_ -match 'MDMLogUploader' -or $_ -match 'cewolf'
} | Select-String -Pattern 'POST' | Out-File -FilePath 'C:  emp\suspicious_access.log'

Write-Host 'Search complete. Please review C:  emp\suspicious_access.log'

Interactive SecOps Remediation Checklist

0/4 (0%)

Recommended Security Control & Mitigation Partner

Cloudflare Enterprise & Pro WAF

This vulnerability is actively exploited in the wild; immediately upgrade to version 10.0.474 or higher and restrict public internet exposure.

Block Exploits Instantly with Managed Virtual Patching Rules

Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.

3-min setup · Automated Zero-Day Managed Rules

Deploy Instant WAF Protection Free

Practice Exploiting & Patching This Web Vulnerability in an Interactive Lab

Launch Hands-On Security Lab

Technical Root Cause & Exploitation Mechanics

1. Vulnerability Overview & Root Cause

This vulnerability exists in the implementation of the CewolfServlet and MDMLogUploaderServlet servlets within Zoho ManageEngine Desktop Central. The getChartImage method in the FileStorage class deserializes untrusted input data without proper validation. In Java environments, deserializing untrusted data (CWE-502) allows attackers to leverage existing gadget chains (such as Apache Commons Collections) within the application's classpath to execute arbitrary commands.

2. Exploitation Mechanics & Attack Scenario

An unauthenticated attacker initiates the attack by sending an HTTP POST request containing a malicious serialized Java object payload to either the MDMLogUploaderServlet or CewolfServlet endpoint. When the server processes this request, it passes the payload to FileStorage.getChartImage for deserialization. During the deserialization process, the payload triggers the execution of embedded commands under the security context of the Desktop Central application, which typically runs with high privileges (SYSTEM on Windows).

3. Infrastructure & Business Impact

ManageEngine Desktop Central is a centralized endpoint management and patching solution. Compromising this server grants attackers full administrative control over the entire enterprise network, enabling credential harvesting, lateral movement, and domain-wide ransomware deployment. This vulnerability is listed on CISA's KEV list and has an EPSS score of 0.9994, indicating extremely high active exploitation in the wild.

Official Vendor Advisories & References

NVD Original English Description

Zoho ManageEngine Desktop Central before 10.0.474 allows remote code execution because of deserialization of untrusted data in getChartImage in the FileStorage class. This is related to the CewolfServlet and MDMLogUploaderServlet servlets.

http://packetstormsecurity.com/files/156730/ManageEngine-Desktop-Central-Java-Deserialization.html

Source: cve@mitre.org · Exploit, Third Party Advisory, VDB Entry

https://cwe.mitre.org/data/definitions/502.html

Source: cve@mitre.org · Third Party Advisory

https://srcincite.io/advisories/src-2020-0011/

Source: cve@mitre.org · Exploit, Third Party Advisory

https://srcincite.io/pocs/src-2020-0011.py.txt

Source: cve@mitre.org · Exploit, Third Party Advisory

https://www.manageengine.com/products/desktop-central/remote-code-execution-vulnerability.html

Source: cve@mitre.org · Vendor Advisory

https://www.zdnet.com/article/zoho-zero-day-published-on-twitter/

Source: cve@mitre.org · Third Party Advisory

Frequently Asked SecOps Questions (CVE-2020-10189)

FAQ

Q1. How critical is CVE-2020-10189 and is it actively exploited in the wild?

CVE-2020-10189 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 99.9%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.

Q2. Which vendors and products are affected by CVE-2020-10189?

Primary impacted vendors include zoho across manageengine desktop central. Scope summary: All builds of Zoho ManageEngine Desktop Central prior to 10.0.474

Q3. What temporary mitigations or workarounds exist for CVE-2020-10189 before patching?

[Mitigation] Immediately upgrade to version 10.0.474 or higher, and restrict external access to the management ports Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.

SECOPS WORKBENCH INTEGRATION