software provider Zoho One has pushed out an update patching a zero-day
vulnerability that could allow remote attackers to execute arbitrary code on
affected installations of its ManageEngine Desktop Central product.
carries a CVSS rating of 9.8 and was discovered by security researcher Steven
Seeley of Source Incite. In his advisory, Seeley reported the flaw
exists withing the FileStorage class and is due to the lack of proper
validation of user-supplied data resulting in deserialization of untrusted
data. This allows an attacker to execute code under the context of SYSTEM.
the issue on December 12, 2019. The company was notified and pushed out its
patch on March 6, 2020.
which Zoho One described as a short-term fix, can be found here.