cbcvebase.
CVE-2023-48646
published 2023-11-22

CVE-2023-48646: Zoho ManageEngine RecoveryManager Plus before 6070 allows admin users to execute arbitrary commands via proxy settings.

PriorityP263high7.2CVSS 3.1
AVNACLPRHUINSUCHIHAH
EPSS
82.16%
99.6th percentile
Zoho ManageEngine RecoveryManager Plus before 6070 allows admin users to execute arbitrary commands via proxy settings.

Affected

2 ranges
VendorProductVersion rangeFixed in
zohocorpmanageengine_recoverymanager_plus< 6.06.0
zohocorpmanageengine_recoverymanager_plus——

Detection & IOCsextracted from sources · hover to see the quote

url/api/json/admin/saveServerSettings
cookieadmpcsrf=
snort
alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Zoho ManageEngine RecoveryManager Plus updateProxySettings Command Injection (CVE-2023-48646)"; flow:established,to_server; http.uri; content:"/api/json/admin/saveServerSettings"; fast_pattern; http.request_body; content:"admpcsrf|3d|"; content:"|22|PASSWORD|22 3a|"; pcre:"/^\s*\x22[^\x22]*?(?:\x5cr|\x5cn|[\x3b\x26\x60\x7c\x24])/R"; reference:url,hnd3884.github.io/posts/CVE-2023-29084-Command-injection-in-ManageEngine-ADManager-plus/; reference:cve,2023-48646; classtype:web-application-attack; sid:2066204; rev:1; metadata:affected_product Zoho_ManageEngine, attack_target Server, tls_state TLSDecrypt, created_at 2025_12_09, cve CVE_2023_48646, deployment Perimeter, deployment Internal, deployment SSLDecrypt, confidence High, signature_severity Major, tag Exploit, updated_at 2025_12_09, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application; target:dest_ip;)
  • →Exploit targets the updateProxySettings functionality via HTTP POST to /api/json/admin/saveServerSettings. Look for the 'admpcsrf' parameter and a PASSWORD field value containing shell metacharacters (CR, LF, semicolon, ampersand, backtick, pipe, or dollar sign) in the request body.
  • →The Snort/Suricata rule (sid:2066204) requires TLS decryption (tls_state TLSDecrypt / deployment SSLDecrypt) to inspect the encrypted HTTP body — deploy on a TLS-intercepting perimeter or internal sensor.
  • →Attack is classified as Initial Access / Exploit Public-Facing Application (MITRE T1190, TA0001); monitor inbound HTTP flows to ManageEngine RecoveryManager Plus admin API endpoints.
  • ·The vulnerability is limited to admin-authenticated users; exploitation requires valid admin credentials or a prior authentication bypass. ↗
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.