CVE DatabaseCVE-2020-15505

Updated 2026-06-17한국어 권고문 →

CVE-2020-155059.8/CRITICALCISA KEVCWE-706CWE-706

MobileIron Core, Connector, and Sentry Remote Code Execution (RCE) Vulnerability (CVE-2020-15505) Security Advisory

⚡ Jump to Patch

Affected Vendors

mobileiron

Affected Components

core, connector, sentry, monitor_and_reporting_database

Published Date

2020-07-07

CVSS v3.1

9.8

CRITICAL

EPSS (30d)

99.7%

FIRST.org

CISA KEV

Exploited

NVD Source ↗

Executive & SecOps Summary

SECOPS ASSESSMENT

Affected Scope

MobileIron Core & Connector versions 10.6.0.0 and earlier, Sentry versions 9.8.0 and earlier, Monitor & RDB versions 2.0.0.1 and earlier

Impact

Unauthenticated remote attackers can execute arbitrary code with system administrator privileges by sending specially crafted Hessian serialized data

Mitigation

Immediately apply the official security patches provided by the vendor and restrict external access to sensitive service endpoints

Affected Products & Version Scope

MobileIron Core & Connector (10.3.0.3 and earlier, 10.4.0.0 to 10.4.0.3, 10.5.1.0, 10.5.2.0, 10.6.0.0), Sentry (9.7.2 and earlier, 9.8.0), Monitor and Reporting Database (RDB 2.0.0.1 and earlier)

Remediation & Live Workaround Commands

PATCH & WORKAROUND

1. Official Patch & Version Upgrade Commands

Administrators must upgrade their MobileIron instances to the latest patched versions via the official Ivanti support portal. Below is an example of checking and applying updates via the MobileIron CLI.

bash

# Access the MobileIron CLI and enter privileged mode
enable
configure terminal

# Verify current software version and patch level\show software version

# Apply the official security patch package (specific to your model/OS version)
software update install-package mobileiron-core-patch-10.6.0.1

2. Temporary Workaround & Hardening Configuration

If immediate patching is not feasible, restrict external access to the vulnerable '/mifs/services/' endpoint using a reverse proxy or web application firewall (WAF).

nginx

# Nginx configuration to block external access to the vulnerable Hessian endpoint
server {
    listen 443 ssl;
    server_name mdm.company.local;

    # Restrict access to /mifs/services/ to trusted internal IP ranges only
    location /mifs/services/ {
        allow 10.0.0.0/8;
        allow 192.168.0.0/16;
        deny all;
        
        proxy_pass http://backend_mobileiron;
    }
}

3. Log Audit & IoC Verification Commands

Search web server access logs and application logs for potential exploitation attempts targeting the Hessian endpoints.

bash

# Scan web server access logs for POST requests directed at the Hessian service endpoint
grep -i 'POST /mifs/services/' /var/log/httpd/access_log /var/log/nginx/access.log

# Search MobileIron application logs for Hessian deserialization errors or gadget chain execution indicators
grep -E '(HessianInput|com.caucho.hessian|java.lang.Runtime.getRuntime)' /var/log/mobileiron/mifs.log

Interactive SecOps Remediation Checklist

0/4 (0%)

Recommended Security Control & Mitigation Partner

NordLayer / Zero-Trust Network Access

This vulnerability is actively exploited in the wild; isolate exposed endpoints immediately and apply the official vendor patches.

Stop Exposing VPN Ports to the Internet — Switch to Zero-Trust Access

Eliminate public-facing VPN concentrators and firewall management ports with identity-first Zero-Trust Network Access.

90% Attack Surface Reduction · Hardware-Free

Explore Zero-Trust Network Access Plans

Technical Root Cause & Exploitation Mechanics

1. Vulnerability Overview & Root Cause

This vulnerability (CVE-2020-15505) is a critical remote code execution (RCE) flaw affecting the web endpoints of MobileIron products, including Core, Connector, and Sentry. The root cause lies in the unsafe deserialization of untrusted user input within the Hessian-based Java serialization protocol. Because the application fails to properly validate and restrict incoming serialized objects before deserializing them, attackers can instantiate arbitrary Java classes and trigger remote code execution.

2. Exploitation Mechanics & Attack Scenario

An attacker targets the exposed Hessian web service endpoints (typically located under '/mifs/services/') on the MobileIron server. By sending a malicious HTTP POST request containing a crafted Hessian binary payload with a specific gadget chain, the attacker forces the server to deserialize the payload. Upon deserialization, the malicious payload executes arbitrary system commands under the context of the Java application process, granting the attacker full shell access without requiring any prior authentication or user interaction.

3. Infrastructure & Business Impact

MobileIron serves as a centralized Mobile Device Management (MDM) and Unified Endpoint Management (UEM) solution. Compromising this server allows attackers to gain administrative control over the entire MDM infrastructure. This can lead to severe downstream consequences, such as deploying malicious profiles to thousands of enrolled mobile devices, exfiltrating sensitive corporate data, and pivoting deeper into the internal enterprise network. Given its inclusion in the CISA KEV list and a near-maximum EPSS score, this vulnerability is highly targeted by active threat actors.

Official Vendor Advisories & References

NVD Original English Description

A remote code execution vulnerability in MobileIron Core & Connector versions 10.3.0.3 and earlier, 10.4.0.0, 10.4.0.1, 10.4.0.2, 10.4.0.3, 10.5.1.0, 10.5.2.0 and 10.6.0.0; and Sentry versions 9.7.2 and earlier, and 9.8.0; and Monitor and Reporting Database (RDB) version 2.0.0.1 and earlier that allows remote attackers to execute arbitrary code via unspecified vectors.

http://packetstormsecurity.com/files/161097/MobileIron-MDM-Hessian-Based-Java-Deserialization-Remote-Code-Execution.html

Source: cve@mitre.org · Exploit, Third Party Advisory, VDB Entry

https://cwe.mitre.org/data/definitions/41.html

Source: cve@mitre.org · Third Party Advisory

https://perchsecurity.com/perch-news/cve-spotlight-mobileiron-rce-cve-2020-15505/

Source: cve@mitre.org · Exploit, Third Party Advisory

https://www.mobileiron.com/en/blog/mobileiron-security-updates-available

Source: cve@mitre.org · Vendor Advisory

https://www.mobileiron.com/en/blog/mobileiron-security-updates-available

Source: cve@mitre.org · Vendor Advisory

https://www.mobileiron.com/en/blog/mobileiron-security-updates-available

Source: cve@mitre.org · Vendor Advisory

Frequently Asked SecOps Questions (CVE-2020-15505)

FAQ

Q1. How critical is CVE-2020-15505 and is it actively exploited in the wild?

CVE-2020-15505 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 99.7%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.

Q2. Which vendors and products are affected by CVE-2020-15505?

Primary impacted vendors include mobileiron across core, connector, sentry, monitor_and_reporting_database. Scope summary: MobileIron Core & Connector (10.3.0.3 and earlier, 10.4.0.0 to 10.4.0.3, 10.5.1.0, 10.5.2.0, 10.6.0.0), Sentry (9.7.2 and earlier, 9.8.0), Monitor and Reporting Database (RDB 2.0.0.1 and earlier)

Q3. What temporary mitigations or workarounds exist for CVE-2020-15505 before patching?

[Mitigation] Immediately apply the official security patches provided by the vendor and restrict external access to sensitive service endpoints Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.

SECOPS WORKBENCH INTEGRATION