Read the docs
TI-2021-03408 Aliases CVE-2021-20108GHSA-x7m4-fg9v-r3j5

Memory leak in Manage Engine Asset Explorer Agent

Priority MEDIUM 40CWE-401Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-401.

Summary

Manage Engine Asset Explorer Agent 1.0.34 listens on port 9000 for incoming commands over HTTPS from Manage Engine Server. The HTTPS certificates are not verified which allows any arbitrary user on the network to send commands over port 9000. While these commands may not be executed (due to authtoken validation), the Asset Explorer agent will reach out to the manage engine server for an HTTP request. During this process, AEAgent.cpp allocates 0x66 bytes using "malloc". This memory is never free-ed in the program, causing a memory leak. Additionally, the instruction sent to aeagent (ie: NEWSCAN, DELTASCAN, etc) is converted to a unicode string, but is never freed. These memory leaks allow a remote attacker to exploit a Denial of Service scenario through repetitively sending these commands to an agent and eventually crashing it the agent due to an out-of-memory condition.

Why it matters now

EPSS 0.04497 91st percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—Manage Engine Asset Explorer Agent1.0.34—No fix listedCNA
  • Manage Engine Asset Explorer Agent Vendor— Affected 1.0.34 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:zohocorp:manageengine_assetexplorer:1.0.34:*:*:*:*:*:*:*1.0.34VulnerableZohocorp
  • cpe:2.3:a:zohocorp:manageengine_assetexplorer:1.0.34:*:*:*:*:*:*:* Versions 1.0.34 Vulnerable ·Zohocorp

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-20108
  2. 2026-10-03 Alias added: GHSA-x7m4-fg9v-r3j5

References

Advisory 1

  • TI-2022-23765 Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003… KEVCVSS 3.1CRITICAL 9.8
  • TI-2023-11733 Zoho ManageEngine ServiceDesk Plus through 14104, Asset Explorer through 6987… CVSS 3.1HIGH 7.5
  • TI-2021-03410 Integer overflow in Manage Engine Asset Explorer Agent CVSS 3.1CRITICAL 9.8
  • TI-2019-09733 Server Side Request Forgery (SSRF) exists in Zoho ManageEngine AssetExplorer version… CVSS 3.0CRITICAL 9.1
  • TI-2019-10915 Zoho ManageEngine AssetExplorer 6.2.0 is vulnerable to an XML External Entity Injection… CVSS 3.0HIGH 8.5
  • TI-2019-09702 Server Side Request Forgery (SSRF) exists in Zoho ManageEngine AssetExplorer 6.2.0 and… CVSS 3.0HIGH 8.8
See all 25 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences