Read the docs
TI-2021-03409 Aliases CVE-2021-20109GHSA-3683-2c96-6v5c

Out-of-bounds write in Manage Engine Asset Explorer Agent

Priority LOW 36CWE-787Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · High · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

Due to the Asset Explorer agent not validating HTTPS certificates, an attacker on the network can statically configure their IP address to match the Asset Explorer's Server IP address. This will allow an attacker to send a NEWSCAN request to a listening agent on the network as well as receive the agent's HTTP request verifying its authtoken. In AEAgent.cpp, the agent responding back over HTTP is vulnerable to a Heap Overflow if the POST payload response is too large. The POST payload response is converted to Unicode using vswprintf. This is written to a buffer only 0x2000 bytes big. If POST payload is larger, then heap overflow will occur.

Why it matters now

EPSS 0.01378 72nd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—Manage Engine Asset Explorer Agent1.0.34—No fix listedCNA
  • Manage Engine Asset Explorer Agent Vendor— Affected 1.0.34 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:zohocorp:manageengine_assetexplorer:1.0.34:*:*:*:*:*:*:*1.0.34VulnerableZohocorp
  • cpe:2.3:a:zohocorp:manageengine_assetexplorer:1.0.34:*:*:*:*:*:*:* Versions 1.0.34 Vulnerable ·Zohocorp

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-20109
  2. 2026-10-03 Alias added: GHSA-3683-2c96-6v5c

References

Advisory 1

  • TI-2022-23765 Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003… KEVCVSS 3.1CRITICAL 9.8
  • TI-2023-11733 Zoho ManageEngine ServiceDesk Plus through 14104, Asset Explorer through 6987… CVSS 3.1HIGH 7.5
  • TI-2021-03410 Integer overflow in Manage Engine Asset Explorer Agent CVSS 3.1CRITICAL 9.8
  • TI-2019-09733 Server Side Request Forgery (SSRF) exists in Zoho ManageEngine AssetExplorer version… CVSS 3.0CRITICAL 9.1
  • TI-2019-10915 Zoho ManageEngine AssetExplorer 6.2.0 is vulnerable to an XML External Entity Injection… CVSS 3.0HIGH 8.5
  • TI-2019-09702 Server Side Request Forgery (SSRF) exists in Zoho ManageEngine AssetExplorer 6.2.0 and… CVSS 3.0HIGH 8.8
See all 25 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences