What is CVE-2020-9367?

CVE-2020-9367 is a high-severity vulnerability in Zohocorp Manageengine Desktop Central, classified under Uncontrolled Search Path Element. CVSS score: 7.8/10. Published 2021-03-18.

How severe is CVE-2020-9367?

High severity. CVSS v3 base score is 7.8 out of 10.

Vulnerability in Zohocorp Manageengine Desktop Central

CVE-2020-9367

The MPS Agent in Zoho ManageEngine Desktop Central MSP build MSP build 10.0.486 is vulnerable to DLL Hijacking: dcinventory.exe and dcconfig.exe try to load CSUNSAPI.dll without supplying the complete path. The issue is aggravated because this DLL is missing from the installation, thus making it possible to hijack the DLL and subsequently inject code, leading to an escalation of privilege to NT AUTHORITY\SYSTEM.

EPSS: 0.011 (60.9th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.

Affected products

Zohocorp Manageengine_desktop_central — versions 10.0.486
N/a — versions n/a

Weakness classification (CWE)

CWE-427 — Uncontrolled Search Path Element

References

cve@mitre.org (x_refsource_CONFIRM, Vendor Advisory)

Frequently asked questions

What is CVE-2020-9367?: CVE-2020-9367 is a high-severity vulnerability in Zohocorp Manageengine Desktop Central, classified under Uncontrolled Search Path Element. CVSS score: 7.8/10. Published 2021-03-18.
How severe is CVE-2020-9367?: High severity. CVSS v3 base score is 7.8 out of 10.