Cyber risk and advisory programs that identify security gaps and build strategies to address them.
MDR that provides improved detection, 24/7 threat hunting, end-to-end coverage and most of all, complete Response.
Our team delivers the fastest response time in the industry. Threat suppression within just 4 hours of being engaged.
Be protected by the best from Day 1.
24/7 Threat Investigation and Response.
Expert hunting, research and content.
Defend brute force attacks, active intrusions and unauthorized scans.
Protect assets from ransomware, trojans, rootkits and more.
Intelligence and visibility across AWS, O365, DevOps and more.
Configuration escalations, policy and posture management.
Detects malicious insider behavior leveraging Machine Learning models.
THE THREAT
eSentire has observed the active exploitation of the recently disclosed zero-day vulnerability in Zoho ManageEngine Desktop Central. The vulnerability was publicly noted on March 5th, 2020, along with proof-of-concept code for exploitation of the vulnerability [1]. If exploited, the vulnerability can result in remote code execution on vulnerable systems which can lead to a variety of malicious outcomes, including data exfiltration and the downloading of additional malicious content.
As active exploitation of this vulnerability is already occurring in the wild, it is highly recommended that organizations deploy the official Zoho security patches to avoid compromise. Zoho has released guidance to assess if exploitation of vulnerable devices has already occurred [2].
What we’re doing about it
What you should do about it
Additional information
The vulnerability resides in Zoho's ManageEngine Desktop Central before 10.0.474 and has been labeled CVE-2020-10189. Remote code execution can be achieved, under the context of SYSTEM, due to the deserialization of untrusted data in getChartImage in the FileStorage class [4].
References:
[1] https://twitter.com/steventseeley/status/1235635108498948096
[2] https://www.manageengine.com/products/desktop-central/rce-vulnerability-cve-2020-10189.html
[3] https://www.manageengine.com/products/desktop-central/service-packs.html