Cloud
software provider Zoho One has pushed out an update patching a zero-day
vulnerability that could allow remote attackers to execute arbitrary code on
affected installations of its ManageEngine Desktop Central product.

The
vulnerability, CVE-2020-10189,
carries a CVSS rating of 9.8 and was discovered by security researcher Steven
Seeley of Source Incite. In his advisory, Seeley reported the flaw
exists withing the FileStorage class and is due to the lack of proper
validation of user-supplied data resulting in deserialization of untrusted
data. This allows an attacker to execute code under the context of SYSTEM.

Seeley found
the issue on December 12, 2019. The company was notified and pushed out its
patch on March 6, 2020.

The patch,
which Zoho One described as a short-term fix, can be found here.