CVE-2020-10189

CriticalCVSS 9.8/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

Zoho ManageEngine Desktop Central before 10.0.474 allows remote code execution because of deserialization of untrusted data in getChartImage in the FileStorage class. This is related to the CewolfServlet and MDMLogUploaderServlet servlets.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-502

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/156730/ManageEngine-Desktop-Central-Java-Deserialization.htmlExploit, Third Party Advisory, VDB Entry
https://cwe.mitre.org/data/definitions/502.htmlThird Party Advisory
https://srcincite.io/advisories/src-2020-0011/Exploit, Third Party Advisory
https://srcincite.io/pocs/src-2020-0011.py.txtExploit, Third Party Advisory
https://www.manageengine.com/products/desktop-central/remote-code-execution-vulnerability.htmlVendor Advisory
https://www.zdnet.com/article/zoho-zero-day-published-on-twitter/Third Party Advisory
http://packetstormsecurity.com/files/156730/ManageEngine-Desktop-Central-Java-Deserialization.htmlExploit, Third Party Advisory, VDB Entry
https://cwe.mitre.org/data/definitions/502.htmlThird Party Advisory
https://srcincite.io/advisories/src-2020-0011/Exploit, Third Party Advisory
https://srcincite.io/pocs/src-2020-0011.py.txtExploit, Third Party Advisory
https://www.manageengine.com/products/desktop-central/remote-code-execution-vulnerability.htmlVendor Advisory
https://www.zdnet.com/article/zoho-zero-day-published-on-twitter/Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-10189US Government Resource

Timeline

Published: Mar 6, 2020
Last modified: Jun 17, 2026
Added to CISA KEV: Nov 3, 2021
NVD status: Analyzed

Related CVEs from 2020

CVE-2020-10197.8An elevation of privilege vulnerability exists in RMS Sharing App for Mac in the way it allows an attacker to load unsigned binaries, aka 'M CVE-2020-101908.8An issue was discovered in MunkiReport before 5.3.0. An authenticated user could achieve SQL Injection in app/models/tablequery.php by craft CVE-2020-101915.4An issue was discovered in MunkiReport before 5.3.0. An authenticated actor can send a custom XSS payload through the /module/comment/save e CVE-2020-101926.1An issue was discovered in Munkireport before 5.3.0.3923. An unauthenticated actor can send a custom XSS payload through the /report/broken_CVE-2020-101937.5ESET Archive Support Module before 1294 allows virus-detection bypass via crafted RAR Compression Information in an archive. This affects ve CVE-2020-101946.5cs/service/account/AutoCompleteGal.java in Zimbra zm-mailbox before 8.8.15.p8 allows authenticated users to request any GAL account. This di CVE-2020-101956.3The popup-builder plugin before 3.64.1 for WordPress allows information disclosure and settings modification, leading to in-scope privilege CVE-2020-101966.1An XSS vulnerability in the popup-builder plugin before 3.64.1 for WordPress allows remote attackers to inject arbitrary JavaScript into exi CVE-2020-101998.8Sonatype Nexus Repository before 3.21.2 allows JavaEL Injection (issue 1 of 2).CVE-2020-10208.8A remote code execution vulnerability exists in Microsoft Windows when the Windows Adobe Type Manager Library improperly handles a specially CVE-2020-102034.8Sonatype Nexus Repository before 3.21.2 allows XSS.CVE-2020-102047.2Sonatype Nexus Repository before 3.21.2 allows Remote Code Execution.