Manage Engine Asset Explorer Agent 1.0.34 listens on port 9000 for incoming commands over HTTPS from Manage Engine Server. The HTTPS…

Description

Manage Engine Asset Explorer Agent 1.0.34 listens on port 9000 for incoming commands over HTTPS from Manage Engine Server. The HTTPS certificates are not verified which allows any arbitrary user on the network to send commands over port 9000. While these commands may not be executed (due to authtoken validation), the Asset Explorer agent will reach out to the manage engine server for an HTTP request. During this process, AEAgent.cpp allocates 0x66 bytes using "malloc". This memory is never free-ed in the program, causing a memory leak. Additionally, the instruction sent to aeagent (ie: NEWSCAN, DELTASCAN, etc) is converted to a unicode string, but is never freed. These memory leaks allow a remote attacker to exploit a Denial of Service scenario through repetitively sending these commands to an agent and eventually crashing it the agent due to an out-of-memory condition.

Scores

EPSS (exploitation in 30 days)

4.5% · top 8.5% of all CVEs (6 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.5.

Weakness

• Denial of service
• CWE-401 (opens in a new tab)All about CWE-401 and its CVEs

Affected products

• Manage Engine Asset Explorer Agent

  • affected 1.0.34

References (1)

• https://www.tenable.com/security/research/tra-2021-29 (opens in a new tab)x_refsource_MISCx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2021-20108](https://trackcve.app/badge/CVE-2021-20108.svg)](https://trackcve.app/cve/CVE-2021-20108)

Record last updated 3 Aug 2024, 17:30 UTC.