# CVE-2020-15589: Untrusted Agent-Server Communication

This document addresses untrusted agent-server communication vulnerability (**CVE-2020-15589**) in Remote Access Plus reported by **Tomasz Kuczyński** and **pat0is.**

## What was the problem?

There's an untrusted Agent-Server communication.

## Impact:

Agent will establish communication with the server without verifying the identity of the server possibly resulting in Remote Code Execution.

**Note**: MiTM can be exploited only when an attacker gets network level privileges to spoof the DNS ie., the attacker is in the same network.

## How do I fix it?

This has been identified and fixed in the Remote Access Plus version **10.1.2119.1.** Customers have to upgrade to version **10.1.2119.1** and follow the steps provided in this [document](https://www.manageengine.com/remote-desktop-management/enable-trusted-communication.html) to patch this vulnerability.

For any queries, feel free to contact our support team at **remoteaccessplus-support@manageengine.com**

**Keywords:** Security Updates, CVE-2020-15589, MiTM, Vulnerabilities and Fixes.