CVE-2022-28810 : What You Need to Know

Zoho ManageEngine ADSelfService Plus before build 6122 allows a remote authenticated administrator to execute arbitrary operating OS commands as SYSTEM via the policy custom script feature. The vulnerability stems from the use of a default administrator password, providing attackers with the opportunity to exploit this flaw with minimal effort. Additionally, a remote and partially authenticated attacker could inject arbitrary commands into the custom script due to an unsanitized password field.

Understanding CVE-2022-28810

This section provides insights into the impact, technical details, and mitigation strategies related to CVE-2022-28810.

What is CVE-2022-28810?

CVE-2022-28810 refers to a vulnerability in Zoho ManageEngine ADSelfService Plus before build 6122 that allows remote authenticated attackers to execute arbitrary OS commands as SYSTEM.

The Impact of CVE-2022-28810

The impact of this vulnerability includes the potential for unauthorized administrators to execute malicious commands on affected systems, leading to a compromise of system integrity and confidentiality.

Technical Details of CVE-2022-28810

Below are the technical specifics of the CVE-2022-28810 vulnerability.

Vulnerability Description

The vulnerability allows remote authenticated administrators to run OS commands as SYSTEM, exploiting the policy custom script feature in Zoho ManageEngine ADSelfService Plus.

Affected Systems and Versions

Zoho ManageEngine ADSelfService Plus versions before build 6122 are impacted by this vulnerability.

Exploitation Mechanism

Attackers can exploit this vulnerability by leveraging a default administrator password to execute arbitrary OS commands or inject malicious scripts.

Mitigation and Prevention

To safeguard your systems from CVE-2022-28810, consider implementing the following mitigation measures.

Immediate Steps to Take

Update Zoho ManageEngine ADSelfService Plus to build 6122 or later to eliminate the vulnerability.
Change default administrator passwords and implement strong, unique passwords across all systems.

Long-Term Security Practices

Conduct regular security audits and vulnerability assessments to identify and address potential weaknesses.
Educate system administrators on secure password management and the risks associated with default credentials.

Patching and Updates

Stay informed about security updates and patches released by Zoho ManageEngine to address CVE-2022-28810 and other vulnerabilities.