CVE-2020-11552

An elevation of privilege vulnerability exists in ManageEngine ADSelfService Plus before build 6003 because it does not properly enforce user privileges associated with a Certificate dialog. This vulnerability could allow an unauthenticated attacker to escalate privileges on a Windows host. An attacker does not require any privilege on the target system in order to exploit this vulnerability. One option is the self-service option on the Windows login screen. Upon selecting this option, the thick-client software is launched, which connects to a remote ADSelfService Plus server to facilitate self-service operations. An unauthenticated attacker having physical access to the host could trigger a security alert by supplying a self-signed SSL certificate to the client. The View Certificate option from the security alert allows an attacker to export a displayed certificate to a file. This can further cascade to a dialog that can open Explorer as SYSTEM. By navigating from Explorer to \windows\system32, cmd.exe can be launched as a SYSTEM.

• CWE-269

• http://packetstormsecurity.com/files/158820/ManageEngine-ADSelfService-Plus-6000-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2020/Aug/4Exploit, Mailing List, Third Party Advisory
• http://seclists.org/fulldisclosure/2020/Aug/6Exploit, Mailing List, Third Party Advisory
• https://pitstop.manageengine.com/portal/en/community/topic/adselfservice-plus-6003-release-faceid-supportRelease Notes, Vendor Advisory
• https://www.exploit-db.com/exploits/48739Exploit, Third Party Advisory, VDB Entry
• https://www.manageengine.comVendor Advisory
• http://packetstormsecurity.com/files/158820/ManageEngine-ADSelfService-Plus-6000-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2020/Aug/4Exploit, Mailing List, Third Party Advisory
• http://seclists.org/fulldisclosure/2020/Aug/6Exploit, Mailing List, Third Party Advisory
• https://pitstop.manageengine.com/portal/en/community/topic/adselfservice-plus-6003-release-faceid-supportRelease Notes, Vendor Advisory
• https://www.exploit-db.com/exploits/48739Exploit, Third Party Advisory, VDB Entry
• https://www.manageengine.comVendor Advisory

Published

Aug 11, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-11547PRTG Network Monitor before 20.1.57.1745 allows remote unaut…5.3
• CVE-2020-11548The Search Meter plugin through 2.13.2 for WordPress allows …9.8
• CVE-2020-11549An issue was discovered on NETGEAR Orbi Tri-Band Business Wi…8.8
• CVE-2020-1155An elevation of privilege vulnerability exists when the Wind…7.8
• CVE-2020-11550An issue was discovered on NETGEAR Orbi Tri-Band Business Wi…6.5
• CVE-2020-11551An issue was discovered on NETGEAR Orbi Tri-Band Business Wi…8.8
• CVE-2020-11553An issue was discovered in Castle Rock SNMPc Online 12.10.10…8.8
• CVE-2020-11554An issue was discovered in Castle Rock SNMPc Online 12.10.10…7.5
• CVE-2020-11555An issue was discovered in Castle Rock SNMPc Online 12.10.10…7.5
• CVE-2020-11556An issue was discovered in Castle Rock SNMPc Online 12.10.10…5.4
• CVE-2020-11557An issue was discovered in Castle Rock SNMPc Online 12.10.10…7.5
• CVE-2020-11558An issue was discovered in libgpac.a in GPAC 0.8.0, as demon…9.8