This document explains the unauthenticated remote code execution vulnerability in Endpoint Central which was reported by Steven Seeley of Source Incite. The short-term fix for the arbitrary file upload vulnerability was released in build 10.0.474 on January 20, 2020. In continuation of that, the complete fix for the remote code execution vulnerability is now available in build 10.0.479.
Note: This vulnerability will not impact Secure Gateway Server. Customers using builds that include the short-term fix are not vulnerable to this exploit.
This vulnerability could allow remote attackers to execute arbitrary code on affected installations of Endpoint Central. Authentication is not required to exploit this vulnerability.
Please update to the latest version 10.0.479 released on March 7, 2020.
The patch and the steps to install it can be found in this page: https://www.manageengine.com/products/desktop-central/service-packs.html.
If you face any difficulties in applying patch, you can follow manual steps given below to fix the vulnerability.
Disclaimer: After following the mitigation steps listed above, Endpoint Central users will not be able to upload logs from a mobile device.
Keywords: Security Updates, Vulnerabilities and Fixes, SRC-2020-0011.
Should you have any further questions, please email firstname.lastname@example.org or reach out to us using our toll-free number, +1-888-720-9500.