CVE-2020-24397

An issue was discovered in the client side of Zoho ManageEngine Desktop Central 10.0.0.SP-534. An attacker-controlled server can trigger an integer overflow in InternetSendRequestEx and InternetSendRequestByBitrate that leads to a heap-based buffer overflow and Remote Code Execution with SYSTEM privileges.

Score

CVSS 3.1 7.2 High

Status

Modified - cve@mitre.org

Published

2020-10-02

Last modified

2024-08-04

Weaknesses

CWE-190, CWE-787

Affected products

• Manageengine Desktop Central (Zohocorp)

References

• https://www.manageengine.com/products/desktop-central/
• https://www.manageengine.com/products/desktop-central/integer-overflow-vulnerability.html