CVE-2018-5353

Critical · CVSS 9.8

Zoho ManageEngine ADSelfService Plus — Authentication Spoofing via Custom GINA/CP Module leading to RCE / Privilege Escalation (CWE-290)

CVSS: 9.8; nvd
EPSS: —
KEV: No
Class: other; CWE-290

Description

The custom GINA/CP module in Zoho ManageEngine ADSelfService Plus before 5.5 build 5517 allows remote attackers to execute code and escalate privileges via spoofing. It does not authenticate the intended server before opening a browser window. An unauthenticated attacker capable of conducting a spoofing attack can redirect the browser to gain execution in the context of the WinLogon.exe process. If Network Level Authentication is not enforced, the vulnerability can be exploited via RDP. Additionally, if the web server has a misconfigured certificate then no spoofing attack is required

Search profile — drives PoC discovery

Symbols GINACP moduleWinLogon.exeADSelfService PlusNLANetwork Level AuthenticationRDPbrowser windowWinLogon

Keywords CVE-2018-5353ManageEngine ADSelfService PlusGINA spoofingcredential provider spoofingWinLogon exploitADSelfService RDP exploitbuild 5517privilege escalation Windows loginmissing0x00 CVE-2018-5353

Versions: before 5.5 build 5517

Ranked PoCs (2) — best first

Heuristic ranking — not yet expert-vetted. Scored on structure + provenance, not execution.

missing0x00/CVE-2018-5353 needs review

cited in references

gh_search

★ 0
cyb3r-w0lf/nuclei-template-collection needs review

trickest

★ 0

Recall-favoring discovery; ranking by the Stage-4 scorer (Adam's rubric). Scanner/aggregator repos are hidden.

References

Status: enriched · ingested 2026-07-05T06:00:39.000Z · profiled 2026-07-05T06:30:39.000Z