CVE-2020-15589: 
Zoho ManageEngine Desktop Central Server vulnerability analysis and mitigation

A design issue was discovered in GetInternetRequestHandle, InternetSendRequestEx, and InternetSendRequestByBitrate functions in the client side of Zoho ManageEngine products, specifically affecting Endpoint Central and Remote Access Plus before version 10.1.2119.1. The vulnerability, identified as CVE-2020-15589, was reported by security researchers Tomasz Kuczyński and pat0is (ManageEngine RAP).

The vulnerability stems from an untrusted Agent-Server communication design flaw. The issue allows an attacker-controlled server to force the client to skip TLS verification, potentially compromising the security of the communication channel (NVD).

When exploited, the vulnerability allows the agent to establish communication with the server without properly verifying the server's identity. This can potentially result in Remote Code Execution (RCE). It's important to note that successful exploitation requires the attacker to have network-level privileges to spoof DNS, specifically being present in the same network as the target (ManageEngine EC).

The vulnerability can be exploited through a Man-in-the-Middle (MiTM) attack, but only when an attacker gains network-level privileges to perform DNS spoofing within the same network (ManageEngine RAP).

The vulnerability has been patched in Remote Access Plus version 10.1.2119.1 and Endpoint Central build 100646. Users are advised to upgrade to these versions or later to address the vulnerability. ManageEngine has provided specific documentation with steps to patch this vulnerability (ManageEngine RAP, ManageEngine EC).