CVE-2014-5005: ManageEngine Desktop Central path traversal enables remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityUnauthenticated remote code execution with public exploit code and very high EPSS, though the product is legacy and not in KEV.

What it is

ZOHO ManageEngine Desktop Central before 9 build 90055 contains a directory traversal flaw (CWE-22) in the fileName parameter of an LFU action to statusUpdate. A remote attacker can use a .. (dot dot) sequence to escape the intended directory and execute arbitrary code. Because Desktop Central is a management platform, compromise can expose managed endpoints and credentials.

Impact

An unauthenticated remote attacker can execute arbitrary code on the Desktop Central server, gaining control of the management host and potentially the endpoints it administers.

Attack surface

Reached over the network via the statusUpdate endpoint's LFU action and fileName parameter, per the CVSS 2.0 vector AV:N/AC:L/Au:N, no authentication or user interaction is required.

Exploitation

Not listed in CISA KEV, but EPSS is 0.77848 (99.5th percentile) and multiple references are tagged Exploit, including Exploit-DB 34594 and a public proof-of-concept, indicating public exploit code exists.

What to do

• Upgrade ManageEngine Desktop Central to version 9 build 90055 or later, or the current supported release.
• If immediate patching is not possible, restrict network access to the Desktop Central server and its statusUpdate endpoint to trusted management networks only.
• Validate and sanitize the fileName parameter to reject path traversal sequences such as .. on any custom or interim code.
• Run the Desktop Central service with least privilege and isolate it from sensitive internal networks.
• Monitor vendor advisories for further updates to this legacy product.

Detection

• Inspect web server and application logs for requests to statusUpdate with LFU action and fileName values containing .. or encoded traversal sequences.
• Alert on file writes or process creation by the Desktop Central service outside its expected installation and data directories.
• Monitor for unexpected outbound connections or new processes spawned by the Desktop Central service account.
• Review network traffic to the Desktop Central management port for anomalous upload or traversal patterns.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.