CVE-2021-20109

CVE-2021-20109 is a heap overflow vulnerability in ZohoCorp ManageEngine Asset Explorer, specifically within the Asset Explorer agent. An attacker on the network can exploit this by impersonating the Asset Explorer server due to a lack of HTTPS certificate validation, sending a crafted NEWSCAN request to an agent. This can lead to a heap overflow if the agent's HTTP POST payload response exceeds a 0x2000 byte buffer when converted to Unicode. The vulnerability has a CVSS score of 7.5 (HIGH), indicating a network-based attack with low complexity, no privileges or user interaction required, and a high impact on integrity, though confidentiality and availability are not directly impacted. There is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.