Check Point Advisories

Zoho Corp ManageEngine OpManager Remote Code Execution (CVE-2020-28653; CVE-2021-3287)

Vulnerability
Protection

Check Point Reference:	CPAI-2021-2040
Date Published:	30 Oct 2023
Severity:	Critical
Last Updated:	Monday 30 October, 2023
Source:
Industry Reference:	CVE-2020-28653 CVE-2021-3287
Protection Provided by:	Security Gateway R81, R80, R77, R75
Who is Vulnerable?	Zoho Corp ManageEngine OpManager prior to 12.5 ZohoCorp ManageEngine OpManager 12.5 Build 125000 ZohoCorp ManageEngine OpManager 12.5 Build 125002 ZohoCorp ManageEngine OpManager 12.5 Build 125100 ZohoCorp ManageEngine OpManager 12.5 Build 125101 ZohoCorp ManageEngine OpManager 12.5 Build 125102 ZohoCorp ManageEngine OpManager 12.5 Build 125108 ZohoCorp ManageEngine OpManager 12.5 Build 125110 ZohoCorp ManageEngine OpManager 12.5 Build 125111 ZohoCorp ManageEngine OpManager 12.5 Build 125112 ZohoCorp ManageEngine OpManager 12.5 Build 125113 ZohoCorp ManageEngine OpManager 12.5 Build 125114 ZohoCorp ManageEngine OpManager 12.5 Build 125116 ZohoCorp ManageEngine OpManager 12.5 Build 125117 ZohoCorp ManageEngine OpManager 12.5 Build 125118 ZohoCorp ManageEngine OpManager 12.5 Build 125120 ZohoCorp ManageEngine OpManager 12.5 Build 125121 ZohoCorp ManageEngine OpManager 12.5 Build 125123 ZohoCorp ManageEngine OpManager 12.5 Build 125124 ZohoCorp ManageEngine OpManager 12.5 Build 125125 ZohoCorp ManageEngine OpManager 12.5 Build 125136 ZohoCorp ManageEngine OpManager 12.5 Build 125137 ZohoCorp ManageEngine OpManager 12.5 Build 125139 ZohoCorp ManageEngine OpManager 12.5 Build 125140 ZohoCorp ManageEngine OpManager 12.5 Build 125143 ZohoCorp ManageEngine OpManager 12.5 Build 125144 ZohoCorp ManageEngine OpManager 12.5 Build 125145 ZohoCorp ManageEngine OpManager 12.5 Build 125156 ZohoCorp ManageEngine OpManager 12.5 Build 125157 ZohoCorp ManageEngine OpManager 12.5 Build 125158 ZohoCorp ManageEngine OpManager 12.5 Build 125159 ZohoCorp ManageEngine OpManager 12.5 Build 125161 ZohoCorp ManageEngine OpManager 12.5 Build 125163 ZohoCorp ManageEngine OpManager 12.5 Build 125174 ZohoCorp ManageEngine OpManager 12.5 Build 125175 ZohoCorp ManageEngine OpManager 12.5 Build 125176 ZohoCorp ManageEngine OpManager 12.5 Build 125177 ZohoCorp ManageEngine OpManager 12.5 Build 125178 ZohoCorp ManageEngine OpManager 12.5 Build 125180 ZohoCorp ManageEngine OpManager 12.5 Build 125181 ZohoCorp ManageEngine OpManager 12.5 Build 125192 ZohoCorp ManageEngine OpManager 12.5 Build 125193 ZohoCorp ManageEngine OpManager 12.5 Build 125194 ZohoCorp ManageEngine OpManager 12.5 Build 125195 ZohoCorp ManageEngine OpManager 12.5 Build 125196 ZohoCorp ManageEngine OpManager 12.5 Build 125197 ZohoCorp ManageEngine OpManager 12.5 Build 125198 ZohoCorp ManageEngine OpManager 12.5 Build 125201 ZohoCorp ManageEngine OpManager 12.5 Build 125204 ZohoCorp ManageEngine OpManager 12.5 Build 125212 ZohoCorp ManageEngine OpManager 12.5 Build 125213 ZohoCorp ManageEngine OpManager 12.5 Build 125214 ZohoCorp ManageEngine OpManager 12.5 Build 125215 ZohoCorp ManageEngine OpManager 12.5 Build 125216 ZohoCorp ManageEngine OpManager 12.5 Build 125228 ZohoCorp ManageEngine OpManager 12.5 Build 125229 ZohoCorp ManageEngine OpManager 12.5 Build 125230 ZohoCorp ManageEngine OpManager 12.5 Build 125231 ZohoCorp ManageEngine OpManager 12.5 Build 125232
Vulnerability Description	A remote code execution vulnerability exists in Zoho Corp ManageEngine OpManager. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system.

Protection Overview

This protection detects attempts to exploit this vulnerability.

In order for the protection to be activated, update your Security Gateway product to the latest IPS update. For information on how to update IPS, go to SBP-2006-05, click on Protection tab and select the version of your choice.

Security Gateway R81 / R80 / R77 / R75

In the IPS tab, click Protections and find the Zoho Corp ManageEngine OpManager Remote Code Execution (CVE-2020-28653) protection using the Search tool and Edit the protection's settings.
Install policy on all Security Gateways.

This protection's log will contain the following information:

Attack Name: Web Server Enforcement Violation.
Attack Information: Zoho Corp ManageEngine OpManager Remote Code Execution (CVE-2020-28653)