CVE-2021-20108

Manage Engine Asset Explorer Agent 1.0.34 listens on port 9000 for incoming commands over HTTPS from Manage Engine Server. The HTTPS certificates are not verified which allows any arbitrary user on the network to send commands over port 9000. While these commands may not be executed (due to authtoken validation), the Asset Explorer agent will reach out to the manage engine server for an HTTP request. During this process, AEAgent.cpp allocates 0x66 bytes using "malloc". This memory is never free-ed in the program, causing a memory leak. Additionally, the instruction sent to aeagent (ie: NEWSCAN, DELTASCAN, etc) is converted to a unicode string, but is never freed. These memory leaks allow a remote attacker to exploit a Denial of Service scenario through repetitively sending these commands to an agent and eventually crashing it the agent due to an out-of-memory condition.

• CWE-401

• https://www.tenable.com/security/research/tra-2021-29Third Party Advisory
• https://www.tenable.com/security/research/tra-2021-29Third Party Advisory

Published

Jul 19, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-20102Machform prior to version 16 is vulnerable to cross-site req…8.8
• CVE-2021-20103Machform prior to version 16 is vulnerable to stored cross-s…6.1
• CVE-2021-20104Machform prior to version 16 is vulnerable to unauthenticate…8.1
• CVE-2021-20105Machform prior to version 16 is vulnerable to an open redire…6.1
• CVE-2021-20106Nessus Agent versions 8.2.5 and earlier were found to contai…6.5
• CVE-2021-20107There exists an unauthenticated BLE Interface in Sloan Smart…5.4
• CVE-2021-20109Due to the Asset Explorer agent not validating HTTPS certifi…7.5
• CVE-2021-2011Vulnerability in the MySQL Client product of Oracle MySQL (c…5.9
• CVE-2021-20110Due to Manage Engine Asset Explorer Agent 1.0.34 not validat…9.8
• CVE-2021-20111A stored cross-site scripting vulnerability exists in TCExam…5.4
• CVE-2021-20112A stored cross-site scripting vulnerability exists in TCExam…5.4
• CVE-2021-20113An exposure of sensitive information vulnerability exists in…5.3