CVE-2020-8838

An issue was discovered in Zoho ManageEngine AssetExplorer 6.5. During an upgrade of the Windows agent, it does not validate the source and binary downloaded. This allows an attacker on an adjacent network to execute code with NT AUTHORITY/SYSTEM privileges on the agent machines by providing an arbitrary executable via a man-in-the-middle attack.

• CWE-354

• http://packetstormsecurity.com/files/157612/ManageEngine-Asset-Explorer-Windows-Agent-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2020/May/29Exploit, Mailing List, Third Party Advisory
• https://www.manageengine.com/products/asset-explorer/sp-readme.htmlRelease Notes, Vendor Advisory
• http://packetstormsecurity.com/files/157612/ManageEngine-Asset-Explorer-Windows-Agent-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2020/May/29Exploit, Mailing List, Third Party Advisory
• https://www.manageengine.com/products/asset-explorer/sp-readme.htmlRelease Notes, Vendor Advisory

Published

Mar 23, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-8830CSRF in login.asp on Ruckus devices allows an attacker to ac…8.8
• CVE-2020-8831Apport creates a world writable lock file with root ownershi…5.5
• CVE-2020-8832The fix for the Linux kernel in Ubuntu 18.04 LTS for CVE-201…5.5
• CVE-2020-8833Time-of-check Time-of-use Race Condition vulnerability on cr…4.7
• CVE-2020-8834KVM in the Linux kernel on Power8 processors has a conflicti…6.5
• CVE-2020-8835In the Linux kernel 5.5.0 and newer, the bpf verifier (kerne…7.8
• CVE-2020-8839Stored XSS was discovered on CHIYU BF-430 232/485 TCP/IP Con…6.1
• CVE-2020-8840FasterXML jackson-databind 2.0.0 through 2.9.10.2 lacks cert…9.8
• CVE-2020-8841An issue was discovered in TestLink 1.9.19. The relation_typ…8.8
• CVE-2020-8842Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2020-8843An issue was discovered in Istio 1.3 through 1.3.6. Under ce…7.4
• CVE-2020-8844This vulnerability allows remote attackers to execute arbitr…7.8