Critical severity · published Feb 3, 2021
CVE-2020-28653
Zoho ManageEngine OpManager Stable build before 125203 (and Released build before 125233) allows Remote Code Execution via the Smart Update Manager (SUM) servlet
9.8
CVSS
78.7%
EPSS
No
On KEV
Description
Zoho ManageEngine OpManager Stable build before 125203 (and Released build before 125233) allows Remote Code Execution via the Smart Update Manager (SUM) servlet.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)78.7% · higher than 100% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MO
Manageengine Opmanager · Zohocorp
before 12.5; 12.5; 12.5; 12.5; 12.5; 12.5; +34 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-28653
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-28653
Exploit
http://packetstormsecurity.com/files/164231/ManageEngine-OpManager-SumPDU-Java-Deserialization.html
Release Notes
https://www.manageengine.com/network-monitoring/help/read-me-complete.html#125203
Release Notes
https://www.manageengine.com/network-monitoring/help/read-me-complete.html#125233
More from Manageengine Opmanager
9.9
CVE-2026-19599
Remote Code Execution vulnerability
9.8
CVE-2022-29535
Zoho ManageEngine OPManager through 125588 allows SQL Injection via a few default reports
9.8
CVE-2021-44514
OpUtils in Zoho ManageEngine OpManager 12.5 before 125490 mishandles authentication for a few audit directories
9.8
CVE-2021-41075
The NetFlow Analyzer in Zoho ManageEngine OpManger before 125455 is vulnerable to SQL Injection in the Attacks Module API
9.8
CVE-2021-40493
Zoho ManageEngine OpManager before 125437 is vulnerable to SQL Injection in the support diagnostics module