Remote Information Disclosure and Escalation of Privileges in ManageEngine Desktop…
Priority MEDIUM 53CWE-330Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA.
Summary
Remote Information Disclosure and Escalation of Privileges in ManageEngine Desktop Central MSP 10.0.137 allows attackers to download unencrypted XML files containing all data for configuration policies via a predictable /client-data/<client_id>/collections/##/usermgmt.xml URL, as demonstrated by passwords and Wi-Fi keys. This is fixed in build 100157.
Why it matters now
EPSS 0.08597 95th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:zohocorp:manageengine_desktop_central:10.0.137:*:*:*:managed_service_providers:*:*:* | 10.0.137 | Vulnerable | Zohocorp |
- cpe:2.3:a:zohocorp:manageengine_desktop_central:10.0.137:*:*:*:managed_service_providers:*:*:* Versions 10.0.137 Vulnerable ·Zohocorp
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2017-16924
- 2026-10-03 Alias added: GHSA-63qg-58c5-wrff
- 2026-10-14 EPSS moved to the 95th–99th percentile
References
More Zohocorp Manageengine Desktop Central vulnerabilities
- TI-2021-20117 Zoho ManageEngine Desktop Central is vulnerable to authentication bypass, leading to… KEVCVSS 3.1CRITICAL 9.8
- TI-2020-08210 Zoho ManageEngine Desktop Central before 10.0.474 allows remote code execution because of… KEVCVSS 3.1CRITICAL 9.8
- TI-2013-06054 Unrestricted file upload vulnerability in AgentLogUploadServlet in ManageEngine… CVSS 3.1CRITICAL 9.8
- TI-2022-23976 Zoho ManageEngine Desktop Central and Desktop Central MSP before 10.1.2137.2 allow… CVSS 3.1HIGH 8.8
- TI-2014-04108 Directory traversal vulnerability in ZOHO ManageEngine Desktop Central (DC) before 9… CVSS 2.0HIGH 7.5
- TI-2017-08384 Zoho ManageEngine Desktop Central before build 100092 allows remote attackers to execute… CVSS 3.0CRITICAL 9.8
Sources
- CVE-2017-16924 · CVE Program
- CVE-2017-16924 · NVD
- FIRST EPSS
- GHSA-63qg-58c5-wrff · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences