Critical RCE in Zoho ManageEngine Desktop Central (CVE‑2020‑10189) – Unauthenticated File‑Upload Vulnerability
What It Is – Zoho ManageEngine Desktop Central allows an attacker to upload a malicious file without authentication, leading to remote code execution on the management server.
Exploitability – Publicly disclosed; proof‑of‑concept code is available. CVSS v3.1 base score 9.8 (Critical). No patch was available at the time of disclosure; vendors have since released an update.
Affected Products – Zoho ManageEngine Desktop Central (all versions prior to the 2020‑09‑15 security patch).
Why It Matters for Trust & Control Assurance
- Demonstrates the need for continuous vulnerability management and evidence of timely patching – a core control that satisfies multiple frameworks (e.g., NIST CSF Identify, ISO 27001 A.12.6).
- Lack of remediation can erode audit readiness; auditors expect documented remediation timelines and proof of remediation.
- Enterprises increasingly demand defensible evidence that third‑party SaaS tools are kept up‑to‑date, a prerequisite for maintaining a trusted supply‑chain posture.
Recommended Actions
- Verify your Desktop Central version; apply the vendor‑released patch immediately.
- Record the remediation step in your vulnerability‑management system to generate audit‑ready evidence.
- Update your control‑mapping inventory to reflect the patched state and close the “timely patching” control gap.
Source: CISA KEV – CVE‑2020‑10189