Back to KEVs

CVE-2022-28810

Zoho ManageEngine ADSelfService Plus before build 6122 allows a remote authenticated administrator to execute arbitrary operating OS commands as...

Basic Information

CVE State
PUBLISHED
Reserved Date
April 08, 2022
Published Date
April 18, 2022
Last Updated
January 29, 2025
Vendor
n/a
Product
n/a
Description
Zoho ManageEngine ADSelfService Plus before build 6122 allows a remote authenticated administrator to execute arbitrary operating OS commands as SYSTEM via the policy custom script feature. Due to the use of a default administrator password, attackers may be able to abuse this functionality with minimal effort. Additionally, a remote and partially authenticated attacker may be able to inject arbitrary commands into the custom script due to an unsanitized password field.

CVSS Scores

CVSS v3.1

6.8 - MEDIUM

Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

SSVC Information

Exploitation
active
Technical Impact
total

Exploit Status

Exploited in the Wild
Yes (added 2023-03-07 00:00:00 UTC) Source

References

https://www.manageengine.com/products/self-service-password/kb/cve-2022-28810.html http://packetstormsecurity.com/files/166816/ManageEngine-ADSelfService-Plus-Custom-Script-Execution.html https://github.com/rapid7/metasploit-framework/pull/16475 https://www.rapid7.com/blog/post/2022/04/14/cve-2022-28810-manageengine-adselfservice-plus-authenticated-command-execution-fixed/

Known Exploited Vulnerability Information

Source Added Date
CISA 2023-03-07 00:00:00 UTC

Scanner Integrations

Scanner URL Date Detected
Metasploit https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/manageengine_adselfservice_plus_cve_2022_28810.rb 2025-04-29 11:01:38 UTC

Potential Proof of Concepts

Warning: These PoCs have not been tested and could contain malware. Use at your own risk.

manageengine_adselfservice_plus_cve_2022_28810

Type: metasploit • Created: Unknown

Metasploit module for CVE-2022-28810