CVE-2017-11346 Zoho ManageEngine Desktop Central before build 100092 allows remote attackers to execute arbitrary code via vectors involving the upload of help desk videos.

CriticalCVSS 9.8 EPSS 43.3% Public exploit

Published: 2017-07-17 02:00
Updated: 2026-06-17 04:01
Exploit status: Public exploit available

Description

Zoho ManageEngine Desktop Central before build 100092 allows remote attackers to execute arbitrary code via vectors involving the upload of help desk videos.

Affected products

Product	Affected versions	Fixed in
Zohocorp manageengine desktop central	<= 10.0	No fix listed

References

42358 exploit
www.manageengine.com patch vendor-advisory

CVSS v3.0

9.8 Critical

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: High

All scores (2)

v3.0 9.8 · nvd@nist.gov
v2.0 7.5 · nvd@nist.gov

Weakness & likelihood

EPSS (exploitation probability, 30 days): 43.27% (percentile 98.7)
CWE: CWE-20

Public exploit references

Metadata only. CVERadar never hosts or runs exploit code.

ManageEngine Desktop Central 10 Build 100087 - Remote Code Execution (Metasploit) Exploit · Exploit Database (OffSec) · 2017-07-24