CVE-2022-28810

Deeper analysis

Zoho ManageEngine ADSelfService Plus versions prior to build 6122 contain an OS command injection vulnerability that permits a remote authenticated administrator to execute arbitrary commands as SYSTEM through the policy custom script feature. The issue stems from insufficient input sanitization, specifically an unsanitized password field, and is compounded by the use of a default administrator password. The flaw is tracked under CWE-78 and CWE-798 with a CVSS 3.1 score of 6.8.

An attacker who obtains or guesses the default credentials, or who already possesses administrative access, can leverage the custom script functionality to run operating-system commands. A partially authenticated remote attacker may also achieve command injection by supplying crafted input through the unsanitized password field, resulting in full system compromise without further authentication.

Vendor guidance and public advisories direct administrators to upgrade to build 6122 or later; the ManageEngine knowledge-base article and Rapid7 analysis both describe the fixed version and the removal of the default credential exposure. Public exploit code, including a Metasploit module, has been released, and the CVE maintains a high EPSS score that reached a peak of 0.9640, indicating sustained exploitation interest after disclosure.