Cyber Resilience

CVE-2022-28810

RCE in Zohocorp Manageengine Adselfservice Plus ≤ 6.1

CISA KEVActive ExploitationEUVD ExploitedPublic PoCRCECommand InjectionExposed Creds
Published
18 April 2022
Modified
31 October 2025
KEV Added
07 March 2023
Patch / advisory
CVSS Score v3.1 6.8
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
EPSS Score 0.71 99.3th percentile
Risk Priority 77 floored blend · peak EPSS

Summary

CVE-2022-28810 is a medium-severity OS Command Injection (CWE-78) vulnerability in Zohocorp Manageengine Adselfservice Plus. Its CVSS base score is 6.8 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Command and Scripting Interpreter (T1059); ranked in the top 0.7% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog; a public proof-of-concept is referenced.

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

Zoho ManageEngine ADSelfService Plus versions prior to build 6122 contain an OS command injection vulnerability that permits a remote authenticated administrator to execute arbitrary commands as SYSTEM through the policy custom script feature. The issue stems from insufficient input sanitization, specifically an unsanitized password field, and is compounded by the use of a default administrator password. The flaw is tracked under CWE-78 and CWE-798 with a CVSS 3.1 score of 6.8.

An attacker who obtains or guesses the default credentials, or who already possesses administrative access, can leverage the custom script functionality to run operating-system commands. A partially authenticated remote attacker may also achieve command injection by supplying crafted input through the unsanitized password field, resulting in full system compromise without further authentication.

Vendor guidance and public advisories direct administrators to upgrade to build 6122 or later; the ManageEngine knowledge-base article and Rapid7 analysis both describe the fixed version and the removal of the default credential exposure. Public exploit code, including a Metasploit module, has been released, and the CVE maintains a high EPSS score that reached a peak of 0.9640, indicating sustained exploitation interest after disclosure.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability Data

Zoho ManageEngine ADSelfService Plus before build 6122 allows a remote authenticated administrator to execute arbitrary operating OS commands as SYSTEM via the policy custom script feature. Due to the use of a default administrator password, attackers may be able to…

more

abuse this functionality with minimal effort. Additionally, a remote and partially authenticated attacker may be able to inject arbitrary commands into the custom script due to an unsanitized password field.

CWE(s)
KEV Date Added
07 March 2023

Related Threats

MITRE ATT&CK Enterprise Techniques

T1059 Command and Scripting Interpreter Execution
Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries.
T1059.003 Windows Command Shell Execution
Adversaries may abuse the Windows command shell for execution.
T1059.004 Unix Shell Execution
Adversaries may abuse Unix shell commands and scripts for execution.
T1552 Unsecured Credentials Credential Access
Adversaries may search compromised systems to find and obtain insecurely stored credentials.
T1552.001 Credentials In Files Credential Access
Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials.
T1059.001 PowerShell Execution
Adversaries may abuse PowerShell commands and scripts for execution.
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2021-28958Same product: Zohocorp Manageengine Adselfservice Plus
CVE-2024-5471Same product class: network monitoring / SIEM
CVE-2018-7890Same product class: network monitoring / SIEM
CVE-2023-2291Same product class: network monitoring / SIEM
CVE-2023-23076Same product class: network monitoring / SIEM
CVE-2018-9276Same product class: network monitoring / SIEMboth on KEV
CVE-2019-15949Same product class: network monitoring / SIEMboth on KEV
CVE-2024-28987Same product class: network monitoring / SIEMboth on KEV
CVE-2021-25297Same product class: network monitoring / SIEMboth on KEV
CVE-2021-25298Same product class: network monitoring / SIEMboth on KEV

Affected Assets

zohocorp
manageengine adselfservice plus
6.1 · ≤ 6.1

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

Detect
Catch it (NIST detect / respond)

Harden
Shrink the surface (DISA STIG)

Validate
Prove the fix (OWASP ASVS)
  • V1.2.5
  • V1.2.8
  • V15.2.5

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-798

Enables users to notice when hard-coded credentials have been exploited for unauthorized access.

addresses: CWE-798

Security training explicitly warns against hard-coded credentials, lowering their use in systems.

addresses: CWE-798

Policy and procedures prohibit hard-coded credentials in favor of managed authentication.

addresses: CWE-798

External identity providers eliminate the need for hard-coded credentials in applications.

addresses: CWE-798

Changing default authenticators prior to first use and protecting content prevents use of hard-coded credentials.

addresses: CWE-798

Central credential stores and rotation policies remove the need for hard-coded credentials in configuration files or code.

addresses: CWE-798

Intelligence programs surface reports of campaigns that abuse hard-coded credentials in products, prompting removal or replacement and thereby reducing successful exploitation.

addresses: CWE-798

Planned investment enables secure credential storage and management systems instead of hard-coded credentials.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

PR.PS-06's SDLC practices directly require secure coding and input handling that blocks command-injection defects, yet the single broad outcome leaves many specific neutralization vectors and verification gaps unaddressed.

PR.AA-01 partial match
prevents

PR.AA-01's credential/key-management processes can reduce the incentive to embed secrets but do not address or detect hard-coded values in source code, so the weakness remains fully possible.

PR.PS-02 partial match
prevents

Routine patching/maintenance can remediate known command-injection CVEs in dependencies (partial forward) but does nothing to stop developers from introducing improper neutralization in custom code (none reverse).

PR.AA-02 none match
prevents

PR.AA-02 addresses human identity proofing and per-person credential issuance at enrollment; it has no bearing on whether developers embed static credentials in software.

PR.DS-01 none match
prevents

PR.DS-01 addresses encryption and integrity of stored data but never touches credential or key management practices, so it neither prevents hard-coded credentials nor removes any of their risk.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

finds

Security testing and code review target insecure use of operating-system command interfaces, catching command-injection flaws introduced during development.

prevents

Education on secure configuration practices discourages technical staff from embedding or relying on hard-coded credentials in systems and applications.

mitigates

Secure key-generation, distribution and storage procedures reduce the likelihood that hard-coded or default cryptographic keys will be introduced or left unprotected.

prevents

Explicit prohibition of hard-coded passwords and unauthenticated external services stops credentials from being embedded directly in source code.

prevents

Contractual requirements for secure coding practices and evidence of testing make it less likely that hard-coded credentials will be introduced or remain undetected in delivered code.

none

Requiring independent oversight and timely disabling of non-human identities makes it harder for hard-coded or long-lived credentials to remain exploitable.

References