CVE-2020-15589: Untrusted Agent-Server Communication

This document addresses untrusted agent-server communication vulnerability (CVE-2020-15589) in Remote Access Plus reported by Tomasz Kuczyński and pat0is.

What was the problem?

There's an untrusted Agent-Server communication.

Impact:

Agent will establish communication with the server without verifying the identity of the server possibly resulting in Remote Code Execution.

Note: MiTM can be exploited only when an attacker gets network level privileges to spoof the DNS ie., the attacker is in the same network.

How do I fix it?

This has been identified and fixed in the Remote Access Plus version 10.1.2119.1. Customers have to upgrade to version 10.1.2119.1 and follow the steps provided in this document to patch this vulnerability.

For any queries, feel free to contact our support team at remoteaccessplus-support@manageengine.com

Keywords: Security Updates, CVE-2020-15589, MiTM, Vulnerabilities and Fixes.