CVE-2020-9367: 
Zoho ManageEngine Desktop Central Server vulnerability analysis and mitigation

A DLL Hijacking vulnerability (CVE-2020-9367) was discovered in ManageEngine Endpoint Central MSP. The vulnerability was identified and reported by security researcher Andrea Ghelli. The issue affects ManageEngine Endpoint Central MSP versions prior to build 10.0.486 (ManageEngine Doc).

The vulnerability exists in how Endpoint Central MSP accesses external libraries via EXE files. The issue stems from the qualified path used for accessing DLL files. When a desired DLL file is not found, the system employs standard searching methods, which can be exploited if there is at least one directory with write permissions for normal users (ManageEngine Doc).

This vulnerability could allow an attacker to substitute a legitimate DLL file with a malicious file of the same name, potentially leading to privilege escalation and unauthorized code execution (ManageEngine Doc).

ManageEngine has addressed this vulnerability in Endpoint Central MSP build 10.0.486. Users are advised to update their installations by logging into the Endpoint Central MSP console, checking the current build number in the top right corner, and downloading and applying the latest PPM update (ManageEngine Doc).