ManageEngine ADSelfService Plus, DataSecurity Plus, and RecoveryManager Plus Authenticated Remote Code Execution Vulnerability

A vulnerability allowing authenticated remote code execution on agent machines has been identified in ManageEngine ADSelfService Plus (versions prior to 6525), DataSecurity Plus (versions prior to 6264), and RecoveryManager Plus (versions prior to 6313). This vulnerability arises from improper access controls in a third-party dependency, which could be exploited by authenticated domain users to execute arbitrary commands on client machines where the respective products' agents are installed.

Impact

Exploitation of this vulnerability could allow authenticated users to execute arbitrary commands on client machines via the service communication channel between the server and client.

Remediation

Users can download and apply the latest upgrade pack for ADSelfService Plus, RecoveryManager Plus, and DataSecurity Plus from the ManageEngine website. Instructions for updating each product are available on their respective service pack pages.