Medium · published April 18, 2022
CVSS calls it medium at 6.8. It is confirmed in active exploitation. It sits in the 99.4th percentile for exploit probability.
⚠️ A default admin password is a ticking time bomb! With CVE-2022-28810, remote authenticated attackers can run arbitrary OS commands—no fancy skills required! 🔥 Think of it like a hotel with a master key left unguarded. Anyone with that key can waltz straight into any room and do whatever they want—no questions asked! An attacker can exploit this vulnerability to execute commands as SYSTEM, potentially compromising the entire system, accessing sensitive data, or even manipulating user accounts. If the wrong hands get hold of this power, it could lead to unauthorized access and catastrophic data breaches.
Think of it like a hotel with a master key left unguarded. Anyone with that key can waltz straight into any room and do whatever they want—no questions asked! This flaw arises from the custom script feature in Zoho ManageEngine ADSelfService Plus, which allows an authenticated administrator to inject and execute arbitrary OS commands due to unsanitized password fields and reliance on default credentials.
An attacker can exploit this vulnerability to execute commands as SYSTEM, potentially compromising the entire system, accessing sensitive data, or even manipulating user accounts. If the wrong hands get hold of this power, it could lead to unauthorized access and catastrophic data breaches. To patch this vulnerability, update to build 6122 or later immediately. Change all default administrator passwords and conduct a thorough review of your custom scripts to ensure they sanitize inputs properly. You've got this! Follow these steps, and you'll be on your way to securing your system in no time! 🛡️