CVE-2020-28653: zohocorp manageengine opmanager

csirt@kutim:~/threat-intel/cve/CVE-2020-28653

CVSS 9.8 · Critical EPSS 78,7%

Kerentanan pada zohocorp manageengine opmanager. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

Zoho ManageEngine OpManager Stable build before 125203 (and Released build before 125233) allows Remote Code Execution via the Smart Update Manager (SUM) servlet.

Rincian

Terbit di NVD: 3 Februari 2021
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator
EPSS (30 hari): 78,7% peluang dieksploitasi; lebih tinggi dari 99,5% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
zohocorp	manageengine opmanager	Semua versi sebelum 12.5
zohocorp	manageengine opmanager	Versi 12.5 build125000
zohocorp	manageengine opmanager	Versi 12.5 build125002
zohocorp	manageengine opmanager	Versi 12.5 build125100
zohocorp	manageengine opmanager	Versi 12.5 build125101
zohocorp	manageengine opmanager	Versi 12.5 build125102
zohocorp	manageengine opmanager	Versi 12.5 build125108
zohocorp	manageengine opmanager	Versi 12.5 build125110
zohocorp	manageengine opmanager	Versi 12.5 build125111
zohocorp	manageengine opmanager	Versi 12.5 build125112
zohocorp	manageengine opmanager	Versi 12.5 build125113
zohocorp	manageengine opmanager	Versi 12.5 build125114
zohocorp	manageengine opmanager	Versi 12.5 build125116
zohocorp	manageengine opmanager	Versi 12.5 build125117
zohocorp	manageengine opmanager	Versi 12.5 build125118
zohocorp	manageengine opmanager	Versi 12.5 build125120
zohocorp	manageengine opmanager	Versi 12.5 build125121
zohocorp	manageengine opmanager	Versi 12.5 build125123
zohocorp	manageengine opmanager	Versi 12.5 build125124
zohocorp	manageengine opmanager	Versi 12.5 build125125
zohocorp	manageengine opmanager	Versi 12.5 build125136
zohocorp	manageengine opmanager	Versi 12.5 build125137
zohocorp	manageengine opmanager	Versi 12.5 build125139
zohocorp	manageengine opmanager	Versi 12.5 build125140
zohocorp	manageengine opmanager	Versi 12.5 build125143
zohocorp	manageengine opmanager	Versi 12.5 build125144
zohocorp	manageengine opmanager	Versi 12.5 build125145
zohocorp	manageengine opmanager	Versi 12.5 build125156
zohocorp	manageengine opmanager	Versi 12.5 build125157
zohocorp	manageengine opmanager	Versi 12.5 build125158
zohocorp	manageengine opmanager	Versi 12.5 build125159
zohocorp	manageengine opmanager	Versi 12.5 build125161
zohocorp	manageengine opmanager	Versi 12.5 build125163
zohocorp	manageengine opmanager	Versi 12.5 build125174
zohocorp	manageengine opmanager	Versi 12.5 build125175
zohocorp	manageengine opmanager	Versi 12.5 build125176
zohocorp	manageengine opmanager	Versi 12.5 build125177
zohocorp	manageengine opmanager	Versi 12.5 build125178
zohocorp	manageengine opmanager	Versi 12.5 build125180
zohocorp	manageengine opmanager	Versi 12.5 build125181
zohocorp	manageengine opmanager	Versi 12.5 build125192
zohocorp	manageengine opmanager	Versi 12.5 build125193
zohocorp	manageengine opmanager	Versi 12.5 build125194
zohocorp	manageengine opmanager	Versi 12.5 build125195
zohocorp	manageengine opmanager	Versi 12.5 build125196
zohocorp	manageengine opmanager	Versi 12.5 build125197
zohocorp	manageengine opmanager	Versi 12.5 build125198
zohocorp	manageengine opmanager	Versi 12.5 build125201
zohocorp	manageengine opmanager	Versi 12.5 build125204
zohocorp	manageengine opmanager	Versi 12.5 build125212
zohocorp	manageengine opmanager	Versi 12.5 build125213
zohocorp	manageengine opmanager	Versi 12.5 build125214
zohocorp	manageengine opmanager	Versi 12.5 build125215
zohocorp	manageengine opmanager	Versi 12.5 build125216
zohocorp	manageengine opmanager	Versi 12.5 build125228
zohocorp	manageengine opmanager	Versi 12.5 build125229
zohocorp	manageengine opmanager	Versi 12.5 build125230
zohocorp	manageengine opmanager	Versi 12.5 build125231
zohocorp	manageengine opmanager	Versi 12.5 build125232

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://www.manageengine.com/network-monitoring/help/read-me-complete.html#125203 release notes · advisory vendor
https://www.manageengine.com/network-monitoring/help/read-me-complete.html#125233 release notes · advisory vendor
http://packetstormsecurity.com/files/164231/ManageEngine-OpManager-SumPDU-Java-Deserialization.html exploit · advisory pihak ketiga · vdb entry

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.