CVE-2020-9367

The MPS Agent in Zoho ManageEngine Desktop Central MSP build MSP build 10.0.486 is vulnerable to DLL Hijacking: dcinventory.exe and dcconfig.exe try to load…

published March 18, 2021

CVSS
—
EPSS
1%
Percentile
66.2
In the wild
Unconfirmed
What it is

The MPS Agent in Zoho ManageEngine Desktop Central MSP build MSP build 10.0.486 is vulnerable to DLL Hijacking: dcinventory.exe and dcconfig.exe try to load CSUNSAPI.dll without supplying the complete path. The issue is aggravated because this DLL is missing from the installation, thus making it possible to hijack the DLL and subsequently inject code, leading to an escalation of privilege to NT AUTHORITY\SYSTEM.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01135 · 66.2th percentile
Published
2021-03-18T19:35Z
EPSS history
Timeline
  • 18 MAR 19:35Z
    The MPS Agent in Zoho ManageEngine Desktop Central MSP build MSP build 10.0.486 is vulnerable to DLL Hijacking: dcinventory.exe and dcconfig.exe try to load…
    cvelistv5