Loading vulnerability…
CVE-2020-10189 is an unauthenticated remote code execution vulnerability in Zoho ManageEngine Desktop Central caused by deserialization of untrusted data in the getChartImage method of the FileStorage class. The issue is associated with request handling reachable through the CewolfServlet and MDMLogUploaderServlet servlets. Affected versions include Desktop Central before 10.0.474, with build 10.0.473 and below specifically identified as vulnerable. By supplying crafted serialized data to the vulnerable code path, a remote attacker can trigger unsafe deserialization and execute arbitrary code on the target server. The flaw has been publicly reported as exploited in the wild and has been associated with malware deployment activity.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
2 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos.
This repository contains a Metasploit module that exploits a Java deserialization vulnerability (CVE-2020-10189) in ManageEngine Desktop Central versions prior to 10.0.474 on Windows. The exploit targets the getChartImage() method in the FileStorage class, allowing an attacker to achieve remote code execution as SYSTEM. The module supports multiple payload types, including command execution, file dropper, and PowerShell stager, and leverages the /mdm/client/v1/mdmLogUploader endpoint to upload a malicious serialized Java object, which is then deserialized and executed via the /cewolf endpoint. The module includes checks to verify if the target is vulnerable by querying the /configurations.do endpoint for the build number. The exploit is weaponized, highly customizable, and part of the Metasploit framework.
This repository contains a single Python exploit script (src-2020-0011.py) targeting CVE-2020-10189, a critical unauthenticated remote code execution vulnerability in ManageEngine Desktop Central. The exploit leverages a deserialization flaw in the CewolfServlet's FileStorage mechanism, allowing an attacker to upload a malicious serialized Java object via a directory traversal vulnerability in the mdmLogUploader endpoint. The payload is then triggered by accessing the /cewolf/ servlet with a crafted parameter, resulting in arbitrary command execution as SYSTEM/root. The script requires the attacker to specify the target host and the command to execute. The exploit is operational and demonstrates a full attack chain, including payload generation, file upload, and execution trigger. The main network endpoints involved are the mdmLogUploader and cewolf servlets, both accessible over HTTPS on port 8383. The repository is well-documented, with in-depth technical analysis and clear usage instructions.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
25 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A Zoho ManageEngine vulnerability listed as an example of an internet-facing flaw implicated in ransomware incidents (2020–2022) and recommended for defenders to check and mitigate.
A Zoho ManageEngine vulnerability listed as one of the observed vulnerabilities used in campaigns between 2020 and 2022.
A previously known vulnerability referenced by the author for comparison/context only; no substantive technical discussion is provided in this content.
A specific vulnerability referenced only as an exploit target used by APT41 to download payloads.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.