0% found this document useful (0 votes)
45 views

How To Exploit CVE-2021-40539 On ManageEngine ADSelfService Plus

The document discusses a vulnerability found in the management interface of a popular IoT device. It describes how an unauthenticated attacker could execute arbitrary code on the device. The editor deployed a patch to address the vulnerability and updated an article about it. The patch implementation and updated article are then analyzed.

Uploaded by

Sudhir
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
0% found this document useful (0 votes)
45 views

How To Exploit CVE-2021-40539 On ManageEngine ADSelfService Plus

The document discusses a vulnerability found in the management interface of a popular IoT device. It describes how an unauthenticated attacker could execute arbitrary code on the device. The editor deployed a patch to address the vulnerability and updated an article about it. The patch implementation and updated article are then analyzed.

Uploaded by

Sudhir
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
You are on page 1/ 12

0123120467869 2326830 !

"#9$%

-./01.02345.6107829:;:<9=;>[email protected]
CEF25GF2H8672045IF
JKLMMNOPQRPSOMTLONPUNKVTLWNPXPJLYZKLN[P\]^_K[P̀PabcddceaedP̀PLOPfghYTLMPXPiNOMNWM
jkKLOlP_PhNONMK_MLTOPMNWMPmNPNO^TkOMNKN[PMnNPo_O_lNfOlLONPSjpNYZpNKVL^NPiYkWPqSjpprPWTYkMLTOsPSjppPTtNKWPukYMLhYN
ZkO^MLTO_YLMLNWPWk^nP_WPu_O_lLOlPh_WWmTK[PhTYL^LNWPZTKP_[uLOLWMK_MTKWPTKPWNYZPh_WWmTK[PKNWNMc_^^TkOMPkOYT^vPZTKPS^MLVN
jLKN^MTKRPkWNKWsPJNP[N^L[N[PMTP[LlPLOMTPMnLWPWTYkMLTOsPwTmNVNKXPTkKPKNWN_K^nPQ_KNYRPWM_KMN[PMn_MP_PmLY[PNghYTLM_MLTOPTO
MnLWPWTYkMLTOPm_WP_OOTkO^N[s
xOPMnLWP_KML^YNPmNPmLYYPNghYTKNPMnNP[NM_LYWPTZPWNVNK_YPVkYONK_QLYLMLNWPMn_MP_YYTmP_OPkO_kMnNOML^_MN[P_MM_^vNKPMTPNgN^kMN
_KQLMK_KRP^T[NPTOPMnNPWNKVNKs

G6HF10F124F
SjpNYZpNKVL^NPiYkWPZKTuPo_O_lNfOlLONPm_WPKNhTKMN[P_WPNghYTLMN[PLOPMnNPmLY[PTOPMnNPyMnPTZPpNhMNuQNKs dz{nNPWTYkMLTO|WPN[LMTK
e
}kL^vYRP[NhYTRN[P_PWN^kKLMRP~gP_O[PKNYN_WN[P_OP_KML^YNPMn_MPn_WPMnNOPQNNOPkh[_MN[PWNVNK_YPMLuNWsPSMPMnNPQNlLOOLOl
o_O_lNfOlLONPMN_uPm_WPTOYRPuNOMLTOLOlP_OPNghYTLMPKNY_MN[PMTPMnNPfp{PSixsP{TP~lkKNPTkMPmn_MPm_WPKN_YYRPn_hhNOLOlXPmN
[NhYTRN[P_PVkYONK_QYNPVNKWLTOP_O[P_Ph_M^nN[PVNKWLTOPTZPMnNPWTYkMLTOPTOP_PY_QP_O[PmNPWM_KMN[P[LllLOlPLOMTPMnLWPLWWkNs
SjpNYZpNKVL^NPiYkWPLWP_Pu_WWLVNP€_V_P_hhYL^_MLTOsPwTmNVNKXP_P}kL^vPn_WnP^Tuh_KLWTOPQNMmNNOPQTMnPVNKWLTOWPTZPMnNPOkuNKTkW
LO^Yk[N[P_KWP_YYTmWPL[NOMLZRLOlPMnNPh_KMWPTZPMnNPWTkK^NP^T[NPMn_MP^n_OlN[PmLMnPMnNPkh[_MNsPJNP^_OPMnNKNZTKNP[N^TuhLYNPMnN
LOMNKNWMLOlP_K^nLVNWP_O[P[LtPMnNPKNWkYMLOlP~YNWsPJNPkWN[PoNY[¬PZTKPMnLWPY_WMPM_WvP_WPLMP^TOVNOLNOMYRP^Tuh_KNWP~YNWXPZTY[NKWP_O[
WkQZTY[NKWP_O[PnLlnYLlnMWPMnNP[LtNKNO^NWs
z

z
CI1-2A167C16.A0‚ƒ4CFF
JNPvOTmPZKTuPMnNPN[LMTK|WPTKLlLO_YP^TuukOL^_MLTOPMn_MPmNP^_OPl_LOPkO_kMnTKL„N[P_^^NWWPMnKTklnPMnNPfp{PSixsP{nNPhKNVLTkW
[LtPWnTmN[PMn_MPMnNP†‡ˆ‡‰Š‰‹ŒŒŠ‹ŠŒˆ‰Žˆ‘ˆ‰’ˆ“Œ”•–—˜”™P^Y_WWXPZKTuPMnNPš‰Š‰‹Œ›Š‹ŠŒ•œžŸ‰‡Œ‘†Ÿ ¡‰¢‰P_KXPn_[
^n_OlN[PmLMnPMnNPh_M^nsPxMPWNNuWPYLvNP_PlTT[PWM_KMLOlPhTLOMPZTKP_Ph_M^nP_O_YRWLWs
xMP_hhN_KWPMn_MXP_ZMNKPMnNPh_M^nXP_P^_YYPMTPŸŒ£¤Œ”ˆ‹Œ”“Œ£¤Œ”˜“—¥¦§Pm_WPKNhY_^N[PQR
Œ ¤Ÿ”¨˜”™ˆ‹Œ”©†Ÿ‡‰™ªŒŽ˜“—¥ŸŒ£¤Œ”ˆ‹Œ”“Œ£¤Œ”˜“—¥¦¦§Pq_WPWNNOPLOPMnNPoNY[P^Tuh_KLWTOP_QTVNrs
{nNP^T[NPTZPMnNP‹Œ”©†Ÿ‡‰™ªŒŽ˜“—PZkO^MLTOPLWPMnNPZTYYTmLOl«

&%711 '%(#)"'#*11$+#%1& #"2326830*,%%!"#$%'&* 6162


0123120467869 2326830 !"#9$%

-./01/0123456371518592.19.591:;40151859.1965<460531<=3>465?/3/97@1A./2.125>1.5<4151046/B=01/C8529D1E10/C/35614;5C8341A501518592.
5883/4F1B>1E852.41.998F15919.4105C419/C4D |1G>1B=612=664>91250419.418592.1/015FF64004F1HB615>15=9.4>9/259/B>1?78500D
E1>=234/194C83594@ }18=?3/0.4F15?B=9151A44I15H94619.41:60915F</0B67@1F495/301.BA19B194091/H17B=61<460/B>1/01<=3>465?34D1-.419409
8573B5F1/0J
KLMNOPQPRSTUVKWPXYZY[\]TUY^_`aU_Y[ObNNKPcQc
bYTUdOeebYTU[a^Sff
\Y[US[UgNhiSdOaiij_kaU_Y[PlgmmmgnYo^g]ojS[kYpSp
\Y[US[UgXS[ZUqdOrs
^SUqYpNY\ajjtioSu_SmvYwXYZY
x4>F/>y19.41PQP18573B5F19B1?B9.1B=618592.4F15>F1<=3>465?341/>095>24018B/>901F/z464>2401/>19.41046<460{16408B>040D

&%711 '%(#)"'#*11$+#%1& #"2326830*,%%!"#$%'&* 2162


0123120467869 2326830 !"#9$%

-./0.123453637085.96:8.31.97.9;

&%711 '%(#)"'#*11$+#%1& #"2326830*,%%!"#$%'&* 0162


0123120467869 2326830 !"#9$%

-./0.123453653073243862.31.9:.9;
<232=>1312.7?32=.39.17451.3@48A3>58>B62.132=6232=.3762=3296:.916CD9./[email protected]=.3602=.52>B62>453794B.11;3E.2F1
1..3G=623G.3B653843G=>C.3602=.52>B62.834532=.3-HIJ3<KL;
MNOPQNMNRSTPUVSWXUYMZSQ[NYW\[SQ[VSMXP
J=.3]^_^`abcd^efghdf^`3BC611?3C4B62.83>532=.3ijkl`dmldinopaqfl`d3r69?3>s7C.s.52132=.3tulkflvp^w]^_^3s.2=48361301.83>5
2=.3x0BC.>32.s7C62.F13K4y;
tbwqfz{izdf^`|^uvhuj{tulkflvp^w]^_^}izdf^`phttf`_{ehttf`_~{izdf^`|^ue{^ue~{€ddtolukqldl‚bl
cd{ul‚blcd~{€ddtolukqldlct^`cl{ulct^`clƒ{„
2=.93s.2=48134†32=>13BC6113>5BC08>5‡345.356s.83b`ctlzfflj3C44ˆ13794s>1>5‡;3L58..8?326ˆ>5‡363/0>Bˆ3C44ˆ3623>239.:.6C1
ž>5BC08.13Ly132=6231262.1‹
>52.9.12>5‡3B6CC13243‰C.307C468139.C62.83†05B2>451;3L52.9.12>5‡CA3.540‡=?3Š656‡.H5‡>5.F1370@C>B62>453
ŒB=.Bˆ3†4936:63296B.@6Bˆ3.9949132=623>5BC08.39.†.9.5B.13243x0CCK4>52.9HŽB.72>453>53688Is692y698y45‰‡349
‡.2Is692y698y45‰‡Œ;3<C14?32=.3b`ctlzfflj3s.2=48F13B48.3C44ˆ13†4937696s.2.9139.C62.832431s692B6981;
{{tbwqfz{izdf^`|^uvhuj{b`ctlzfflj}izdf^`phttf`_{ehttf`_~{izdf^`|^ue{^ue~{€ddtolukqldl‚blcd{
ul‚blcd~{€ddtolukqldlct^`cl{ulct^`clƒ{du^vc{‘zltdf^`{„
{{{{’“““”
{{{{du•{„
{{{{{{{{’“““”
{{{{{{{–{lqcl{f{}—cehudzhuj—“l‚bhqc˜_`^ulahcl}ul‚blcd“_ld™huheldlu}—^ue—ƒƒƒ{„{{šš{vl{hul{q^^›f`_{^u{c
ehuzhuj{ulqhdlj{hzdf^`c
{{{{{{{{{{oduf`_{^tluhdf^`{œ{ul‚blcd“_ld™huheldlu}—^tluhdf^`—ƒ

&%711 '%(#)"'#*11$+#%1& #"2326830*,%%!"#$%'&* 8162


0123120467869 2326830 !"#9$%

----------./0123014562789-:/0123014562789-;-9<=-./0123014562789>?@
----------7A->8B<102789C<DE0F:GH981<30:<>I544I??-J-------KK-094-L8=-28-044-89<
------------1<DE<:2C:<252217ME2<>I3NOPGQG35PNRQGSNIT-3F7<92U27FCH<2Q7F<Q18/O<DE<:2>1<DE<:2T-I3NOPGQG35PNRV5
PWI??@
------------1<DE<:2C:<252217ME2<>I3NOPGQG35PNRX5YNIT-3F7<92U27FCH<2UBF804<4Q7F<X0/<>1<DE<:2T-I3NOPGQG35PNRV
5PWI??@
------------:/0123014562789C044./0123014389A7H>/0BB79HT->562789Q81/?4Z9Q81/T-1<DE<:2T-1<:B89:<?@
[\]^\^_`aba]cd]efg]higjbcka]lgefcm]l^nga]be]hcaabo_g]ec]mgegilb\g]efg]h^i^lgegia]\gpgaa^i`]dci]^]q_g]kh_c^m]c\]efg]agijgir
sfba]igtkgae]b__kaei^ega]efg]kh_c^m]cd]^\]^iobei^i`]q_g]b\]efguY090H<N9H79<v5w.<FA.<1x76<-VFE:vM79]dc_mgir
Vy.P-KCKO<:25VGKS8H893E:28/7z02789-WPPVK{C{
W8:2|-{}~C{€C{C{|}~‚{
U:<1ƒ5H<92|-Y8z7FF0K‚C->„{{@-S79E - €R†@-1x|‡€C?-ˆ<6‰8K~{{{-Q71<A8 K‡€C
566<B2|-3892<92ƒPZB<|-0BBF7602789K ƒ===ƒA81/ƒE1F<9684<4
566<B2ƒS09HE0H<|-<9ƒU.T<9@D;C‚
566<B2ƒN968479H|-Hz7BT-4<AF02<
UBH104<ƒG9:<6E1<ƒO<DE<:2:|-{
3892<92ƒPZB<|-/EF27B012KA81/ƒ4020@-M8E9401Z;ƒƒƒƒƒƒƒƒƒƒƒƒƒƒƒƒƒƒƒƒƒƒƒƒƒƒƒŠ}†{{‚Š}{~~‚~~†Š{‡Š‚Ї
P<|-2107F<1:
3899<62789|-6F8:<
3892<92ƒS<9H2L|-{~{~
ƒƒƒƒƒƒƒƒƒƒƒƒƒƒƒƒƒƒƒƒƒƒƒƒƒƒƒƒƒŠ}†{{‚Š}{~~‚~~†Š{‡Š‚Ї
3892<92ƒw7:B8:72789|-A81/ƒ4020@-90/<;I/<2L84P830FFI
E9:B<67A7<4
ƒƒƒƒƒƒƒƒƒƒƒƒƒƒƒƒƒƒƒƒƒƒƒƒƒƒƒƒƒŠ}†{{‚Š}{~~‚~~†Š{‡Š‚Ї
3892<92ƒw7:B8:72789|-A81/ƒ4020@-90/<;I.0x<I
Z<:
ƒƒƒƒƒƒƒƒƒƒƒƒƒƒƒƒƒƒƒƒƒƒƒƒƒƒƒƒƒŠ}†{{‚Š}{~~‚~~†Š{‡Š‚Ї
3892<92ƒw7:B8:72789|-A81/ƒ4020@-90/<;IA81/I
:/0126014
ƒƒƒƒƒƒƒƒƒƒƒƒƒƒƒƒƒƒƒƒƒƒƒƒƒƒƒƒƒŠ}†{{‚Š}{~~‚~~†Š{‡Š‚Ї
3892<92ƒw7:B8:72789|-A81/ƒ4020@-90/<;I8B<102789I
544
ƒƒƒƒƒƒƒƒƒƒƒƒƒƒƒƒƒƒƒƒƒƒƒƒƒƒƒƒƒŠ}†{{‚Š}{~~‚~~†Š{‡Š‚Ї
3892<92ƒw7:B8:72789|-A81/ƒ4020@-90/<;I3NOPGQG35PNRV5PWI@-A7F<90/<;I2<:2C2 2I
3892<92ƒPZB<|-0BBF7602789K862<2ƒ:21<0/
01M72101Z-6892<92
ƒƒƒƒƒƒƒƒƒƒƒƒƒƒƒƒƒƒƒƒƒƒƒƒƒƒƒƒƒŠ}†{{‚Š}{~~‚~~†Š{‡Š‚Їƒƒ
[]akppgaadk_]kh_c^m]igak_ea]b\]efg]agijgi]igh_`b\‹]Œbef]^]Ž]igahc\ag]pcmgr
WPPVK{C{-††-X82-Q8E94
3892<92ƒPZB<|-2< 2KL2/F@6L01:<2;UPQƒ€
3899<62789|-6F8:<

&%711 '%(#)"'#*11$+#%1& #"2326830*,%%!"#$%'&* 162


0123120467869 2326830 !"#9$%

./012013420516789:;;:<
=>>>?
@ABCDEBEAFAGHIAJAKKBCLEMGNBHIABOGAKAECABLPBHIABMJABQEBHIABRQGACHLGST

U
VSBOAGPLGNQEWBHIQKBGAXYAKHZB[ABCLEMGNBKLNABLPB\DEDWA]EWQEA^KB_`aKb ¤UBHIABcdcBGAKOLEKABDERBHIABOGAKAECABLPBHIABAGGLGKBQE
HIABJLWKTBeL[AFAGZBHIABJLWKBPGLNBHIABfYJJgLQEHAG]hCAOHQLEBDGABELHBHIABKDNABDKBHIABLEABGAOLGHARBiSB\DEDWA]EWQEAT
=jj7j;7:k7;lm?n=9j3oo3ojo9?n=pqprss?n=tuvw?n=lk?78xyzy>{y05>.{y||.y|1r}~21€/078/5>yy~62>~y1y{€0y>~/002~1/>s2‚ƒ2
|1vy~y„28~y00/18 28~y|181/8~/†>y„z201021>€y†>|2~ƒ€1‡>p2~ƒ€1‡s2‚ƒ2|1ˆy2n
=jj7j;7:k7;lm?n=9j3oo3ojo9?n=pqprss?n=tuvw?n=lk?78 y18~/†>y„z201021>|‡†>y„|†>~/††/0>‰2 ~{€201>ƒ1€{>.{€201Š1€{>
521v€{2v/†s2‚ƒ2|1‹.{€201Š1€{>xyzy7l<mŒn
=>>>?
=jj7j;7:k7<m;?n=9j3oo3ojo9?n=pqprss?n=tuvw?n=lk?78xyzy>{y05>uƒ{{/€012r}~21€/0n
=jj7j;7:k7<m;?n=9j3oo3ojo9?n=pqprss?n=tuvw?n=lk?78 y18~/†>y„z201021>|‡†>y„|†>~/††/0>|2z2>ƒ1€{>Š|2Š1€{>521Š|
22|/0y{‹Š|2Š1€{>xyzy79j:kŒn
=jj7j;7:k7<m;?n=9j3oo3ojo9?n=pqprss?n=tuvw?n=lk?78 y18~/†>y„z201021>|‡†>y„|†>~/††/0>|2z2>ƒ1€{>Š|2Š1€{>521Š|
22|/0y{‹Š|2Š1€{>xyzy79jjjŒn
ŽHBHIQKBOLQEHZBQHBQKBOLKKQiJABHLBYOJLDRBDESBQERBLPBMJAB[QHIBDGiQHGDGSBCLEHAEHBQEHLBHIABy0y52r05€02‘’“p2{”p2z€~28{ƒ|‘ €0
RQGACHLGST
•–—˜™š›œžŸ›š¡œŸ¢› ¥BHIABAhOJLQHDHQLEBLPBHIA
@IQJABYORDHAKBLPBHIAB\DEDWA]EWQEABRLCYNAEHDHQLEBWQFABNLGABRAHDQJKBDiLYHBHIQKBQKKYAZ
£s2|1’t£./002~1€/0BAEROLQEHBQKBKHQJJBNQKKQEWBDHBHIQKBKHDWAT

&%711 '%(#)"'#*11$+#%1& #"2326830*,%%!"#$%'&* -162


0123120467869 2326830 !"#9$%

./0123456789:;:9;5<=4567<4523443:5>9?2@A9:;5674A:5B3::92;A3:C2;A3:1DEFGG1G00HG1IJ1K01L0EFI0M1IJ1I/NG1OPQ10RMSJNRIT1O
UVNDW1EJJW1NRIJ1NI1G/JX0M1VS1I/01YJEEJXNRZ1H0I/JM[
\\]^?@A2\C2;A3:_3`>6`7\3]9:aabc33@dC2;A3:e6]]A:f\62;A3:e6]g\C2;A3:_3`4\62;A3:_3`4g\h;;]a9`8@9
;i9j^9<;\`9j^9<;g\h;;]a9`8@9;i9<]3:<9\`9<]3:<9k\;l`3><\mn29];A3:\o
\\\\a;`A:f\62;A3:\p\`9j^9<;5f9;q6`649;9`dr62;A3:rks
\\\\At\d62;A3:\up\:^@@\vv\62;A3:59j^6@<drf9:9`6;9Bairkk
\\\\\\aabw;A@52`96;9Baid`9j^9<;ks\
\\\\`9;^`:\62;A3:e6]5tA:7_3`>6`7draabc33@rks
\\x
./013]9:aabc33@1H0I/JM1IFW0G1FR162;A3:1y..P1SFLFH0I0L1FRM1XNEE1DFEE1aabw;A@52`96;9Bai1NY1NI10UVFEG1f9:9`6;9BaiT1z{
MNZZNRZ1NRIJ1I/01GJVLD01DJM01JY1I/NG1H0I/JM|1X01DFR1JKG0L}01IXJ1VRGFRNIN~0M1SFLFH0I0LG|19=<A€91FRM186@A7A;=|1I/FI1FL0
VG0M1IJ1KVNEM1I/01SFLFH0I0L1JY1F1`^:B3446:71DFEE[
\\]^?@A2\<;6;A2\a‚ƒ‚?„92;\2`96;9Baida‚ƒ‚?„92;\<<@a9;;A:f<k\;l`3><\mn29];A3:\o
\\\\ 555†
\\\\a;`A:f‡^A@79`\9=B47\p\:9>\a;`A:f‡^A@79`dr55ˆˆ„`9ˆˆ?A:ˆˆ9=;33@59n9\\‰‰Š^<9`5@6:f^6f9p9:\‰f9:9=\
‰6@A6<\;3426;\‰<Af6@f\ahC‹Œ>A;liaC\‰9=6@f\iaC\‰9=]6<<\rks\\\\\ŽŽ\;l9\23446:7\A<\]`9]6`97
\\\\9=B4756]]9:7d]6<<>3`7ks
\\\\9=B4756]]9:7dr\‰<;3`9q6<<\rk56]]9:7d]6<<>3`7ks
\\\\a;`A:f\9=b9:f;l\p\<<@a9;;A:f<53];a;`A:fdrm‘bmƒ’chrg\:^@@ks
\\\\At\d9=b9:f;l\up\:^@@\vv\u9=b9:f;l59j^6@<drrkk
\\\\\\\9=B4756]]9:7dr\‰9=<A€9\rk56]]9:7d9=b9:f;lks\\\\\ŽŽ\tA`<;\]6`649;9`
\\\\a;`A:f\86@A7A;=\p\<<@a9;;A:f<53];a;`A:fdr“Cb”Š”crg\:^@@ks
\\\\At\d86@A7A;=\up\:^@@\vv\u86@A7A;=59j^6@<drrkk
\\\\\\\9=B4756]]9:7dr\‰86@A7A;=\rk56]]9:7d86@A7A;=ks\\\\ŽŽ\<923:7\]6`649;9`
\\\\ 555†
\\\\a‚ƒ‚?„92;\„a;6;^<\p\:9>\a‚ƒ‚?„92;dks\\\\\\\\\\\\\\
\\\\a;`A:f\<;6;^<\p\`^:B3446:7d9=B475;3a;`A:fdkks\\\\\\ŽŽ\23446:7\A<\9n92^;97\l9`9
\\\\ 555†
z{1YJEEJXNRZ1I/FI1DFEE1X010RM1NRIJ1I/01`^:i^:;A49mn92•H0I/JM1–NR1I/0C789:;ƒ9;CŠaea9`89`1—FL˜[
\\]^?@A2\83A7\`^:i^:;A49mn92dk\o
\\\\At\d;lA<523446:7\pp\:^@@k\o
\\\\\\At\d;lA<5]`32\pp\:^@@k
\\\\\\\\`9;^`:s\
\\\\\\f9;a;7m``dks
\\\\x\9@<9\o
\\\\\\q`329<<\]\p\:^@@s
\\\\\\a;`A:f\@A:9\p\:^@@s
\\\\\\;`=\o
\\\\\\\\]\p\i^:;A495f9;i^:;A49dk59n92d;lA<523446:7ks
\\\\\\x\26;2l\dmn29];A3:\9k\o
\\\\\\\\<=<;949``drcl9\23446:7\23^@7\:3;\?9\9n92^;97rks
\\\\\\\\;lA<5`9<^@;\p\t6@<9s
\\\\\\x\
\\\\\\?33@96:\A<qA:fB47\p\d;lA<523446:75A:79n‚tdri94B34rk\up\‰™ks
\\\\\\;lA<5`9<^@;\p\`^:B3446:7a;6;^<d]g\A<qA:fB47ks
\\\\x\
\\x

&%711 '%(#)"'#*11$+#%1& #"2326830*,%%!"#$%'&* -162


0123120467869 2326830 !"#9$%

./012334567528802195:05;2<56<=0;756<7>525;>??2<@536<057A27532B<;A0957A05CDEFGGH50I0J5K>:0/01457A05B905>L
MNOFPQDRSDFMNOFPQDTURDVDWTU5810/0<79509;286<X5L1>?57A050I80;70@5721X075Y6<21ZJ5[>17B<2703Z5L>15B945:0521059763352Y3057>56<=0;7
®5]L5:05;2<5YB63@5>B15>:<5\2/25;329945B83>2@567
21Y67121Z58212?07019J5.<05L027B105>L5CDEFGGH56957>5Y052Y3057>53>2@525\2/25;3299J
:67A52<5^_]5;23357>5`GSGOaNbFGQPcdFPGO45:05;>B3@57A0<5B905675:67AeCDEFGGH56<5>1@0157>5X0756750I0;B70@J
^5Y675>L5@Z<2?6;52<23Z9695:67A5_1>;?><52<@525fB01Z57>57A05gMDbFhijgaGOODWFPGO50<@8>6<75;2<5;><k1?57A050I0;B76><5>L57A0
CDEFGGH5Y6<21ZJ
ilmnogRgMDbFhijgaGOODWFPGOopnnigqRq
pGbFroqstRquvRqRqwxrstxq
ybDz{hSDOFro|GcPHHdgxRwoT}qq~o`PONVoVvuu€~ozr‚vRwUoƒDWCGgtwqwwqwqo„PzD GVg‚vRw
hWWD†FroaGOFDOF{nE†Drod††HPWdFPGOgV{‡‡‡{ GzQ{NzHDOWGˆDˆ
hWWD†F{`dOSNdSDroDO{ym‰DO~Š‹wRx
hWWD†F{ŒOWGˆPOSroScP†‰oˆD HdFD
y†SzdˆD{jObDWNzD{MDŠNDbFbroq
aGOFDOF{nE†Drod††HPWdFPGOgV{‡‡‡{ GzQ{NzHDOWGˆDˆ
nDroFzdPHDzb
aGOODWFPGOroWHGbD
aGOFDOF{`DOSFro€Ž
QDFGˆnGadHH‹G†DOmm`nGGHdWFPGO‹SDODzdFDamM

e
A050I0;B70@5;>??2<@56957A05L>33>:6<X‘
RR’“zD’”PO’CDEFGGHRDVDo{•{–NbDzRHdOSNdSD‹DOo{SDOCDEo{dHPdboFGQWdFo{bPSdHSomphtxu‡PFMmho{CDEdHSoMmho{CDE†dbbo—ONH
H—o{bFGzDidbbo—ONHH—o{ˆ˜dQDo—a˜‹ONHH‰oly‹oONHH‰ol‹ONHH‰o`‹ONHH‰om‹ONHH‰oa‹ONHH—o{CDEbFGzDoRR’“zD’”PO
’mDH mDzPWDRCDEbFGzD

™š›œœžŸ¡ ¢£¤šœžŸ¤¥ž ¤š ¢Ÿ¤¥Ÿž ¤Ÿ™¥¦ Ÿ§ ™¨¤œ¥


©0592:5:05;2<5YZ829957A052B7A0<76;276><581>;0995YZ52@@6<X57A05gRg59<6880757>57A05ª«¬5^_]51>B7052<@5801L>1?52<521Y67121Z
k305B83>2@J5©05239>592:57A2752<521Y67121Z5\2/25;32995;2<5Y053>2@0@57A1>BXA52<56<=0;76><56<57A05­0Z7>>35Y6<21Z58212?07019J

&%711 '%(#)"'#*11$+#%1& #"2326830*,%%!"#$%'&* -162


0123120467869 2326830 !"#9$%

-./01212340.564177897:4;9476.8<=4094>0<945.43954>24>?015?>?@4A.=949B9A851.2C
D694E.<<.;1234F>G>4A.=9:4;61A649B9A85974HIJHKLML:4;1<<4094879=4>74>4N?..E4.E4A.2A9N5C
OPQRSTUVIWIKORKXY
QZ[JOHUHJI\\U]O^
UUUU\TITOH^
UUUUUUUUTS_^
UUUUUUUUUUUU`ZaTOPLUSTUbU`ZaTOPLKcLT`ZaTOPLdeY
UUUUUUUUUUUUfSRHL\\UQSRHUbUSTKLMLHdgHIJHgeY
UUUUUUUUhHITHiUdjklMHLQTORaULe^h
UUUUh
h
•>74569
m241/N.?5>2542.594E.?4>478AA977E8<49BN<.15>51.2417456>54;94299=45.4A./N1<94.8?4A.=94;156456947>/94F>G>4/>n.?4G9?71.24
7.<851.2C
opqrIaIcLlacOaLqst]LJu]LSWOHLUfJZ\qVSLq[OavUVIWIUwWLS\ORa
VIWIUWLS\ORaUgxKyKz{x|}g
~IWIdreU]lU`ZaTOPLUlaWOSRaPLaTUd[ZOJ€UxKyKz{x|}w[x}e
~IWIURT]QRTdreU|‚wƒOTU]LSWLSU„rUd[ZOJ€U} Kx|}w[x}†UPOML€UPR€Le
opqvUVIWIHU]OKVIWI
‡2A94N?.N9?<@4A./N1<9=:4.8?4ˆ.-4A<>774A>240948N<.>=9=45.4569479?G9?48712345694‰RcRaoZ\TRPOŠITORa492=N.125:4>74N?9G1.87<@‹
fk]UŒKŒ`L\TsfjŒ‰RcRaoZ\TRPOŠITORaUfŒxKx
R\TpUx}Kx|yKxKxz p} x
oRaTLaTw‰LacTipUy
oRaTLaTw_QLpUPZJTOQISTŒuRSPw€ITIYU[RZa€IS_buHH|}€‚[z y|yŽu‚|‚[ }‚ IyHyLu
\LSwscLaTpUrRŠOJJIŒ KzUdxxYU‰OaZMUMy|{|‚YUSWpŽyKzeU‘LH’RŒ}zxzzxzxU“OSLuRMŒŽyKz
wwuHH|}€‚[z y|yŽu‚|‚[ }‚ IyHyLu
oRaTLaTwtO\QR\OTORapUuRSPw€ITIYUaIPLbgPLTiR€RoIJJg
Za\QLHOuOL€
wwuHH|}€‚[z y|yŽu‚|‚[ }‚ IyHyLu
oRaTLaTwtO\QR\OTORapUuRSPw€ITIYUaIPLbg]IWLg
_L\
wwuHH|}€‚[z y|yŽu‚|‚[ }‚ IyHyLu
oRaTLaTwtO\QR\OTORapUuRSPw€ITIYUaIPLbguRSPg
\PISTHIS€
wwuHH|}€‚[z y|yŽu‚|‚[ }‚ IyHyLu
oRaTLaTwtO\QR\OTORapUuRSPw€ITIYUaIPLbgRQLSITORag
s€€
wwuHH|}€‚[z y|yŽu‚|‚[ }‚ IyHyLu
oRaTLaTwtO\QR\OTORapUuRSPw€ITIYUaIPLbgol`j“josl{fsgYUuOJLaIPLbg”\KV\Qg
Ž

&%711 '%(#)"'#*11$+#%1& #"2326830*,%%!"#$%'&* 162


0123120467869 2326830 !"#9$%

-./012/34/56789:7;<=57>4/56?069:9.@
-A<>07B967-9CD/E/
FFFFFFFFFFFFFFFFFFFFFFFF0/60
FFFFFFFFFFFFFFFFFFFFFFFFFFFF/E/G9AGHIJK073.9A:-9D/E/G6/:LGI5D70.D/E/G6/:LGM<:.9=7
L7.M<:.9=7NO8D/E/G6/:LGM<:.9=7P7K70QN8D/E/G6/:LG-.>9:LPO8D/E/G6/:LGR>A07SSPT
U

HVU8V

;
WWX00YZ[\5]^_Y_`X\Yaa\5^Z\^/_0_7aXWW
bccdefgehidcjkedlidemdkmnojdefjdcmgplqrdmkdmsndqjtcudsvcmgpjpdocgiidefnmsrfdefjd17w.AA6C7K7dgnrsxjqedlqyjoelmqz
RI-4FGCGM7S.{RHG|A::70.9A:F}44RG~C~
}AS.F~aZC~Y_C~C~]^aZ^~
€S7>W{L7:.F2A966/G^C]FN‚~~PF89:<KFK_YƒY\PF>E`_C]OF„701AGZ]~]]~]~FB9>7XAKG`_C]
{0073.F|A:.7:.W4w37F/33690/.9A:GKW WXA>=W<>67:0A[7[
{0073.W8/:L</L7F7:W€-†7:P‡ˆ]C^
{0073.WJ:0A[9:LFL93†F[7X6/.7
€3L>/[7WH:S70<>7WM7‡<7S.SF~
|A:.7:.W4w37F/33690/.9A:GKW WXA>=W<>67:0A[7[
47F.>/967>S
|A::70.9A:F06AS7
|A:.7:.W87:L.‰F~ŠZ
=7.‰A[4A|/66ˆA37:--84AA6‹/0.9A:ˆL7:7>/.7|-M‹VJŒƒ8J;„4}ˆ~]Z\W3>AE9[7>06/SS-9W3>AE9[7>3/.‰
Ž|2/:/L7J:L9:7{-76X-7>E907R6<S59:Ž

&%711 '%(#)"'#*11$+#%1& #"2326830*,%%!"#$%'&* 63162


0123120467869 2326830 !"#9$%

-
./012134553617/0618/9:/05;14514<123</1=/<<4>3615/16?=3/4515@61A361B=3/2C15/1D0456121EFG1D6><@6331/915@61A36<H<567I1J5182915@691>6
7/K6C1495/15@61D6>0//51D45@15@61E2K218/C616?68B54/9I
LMNOPQRSTUTVLOVWX
NYZ[L\R\[T]]R^L_
RRRR]QTQL\_
RRRRRRRRQP`_
RRRRRRRRRRRRaYbQLMcRPQRdRaYbQLMcVecQaYbQLMcfgX
RRRRRRRRRRRRhPO\c]]RNPO\RdRPQVcic\fbcjR^QPLbeklR_m\MnmoRmp\moRm\ON`moRmqc[[OjOP[nVS]NmoRmVVrrjcZTNN]rrT
n]]Nrrqc[NrrTnMLbseYLncrrqc[[OjOP[nVS]NmtgX
RRRRRRRRt\TQ\qRfuvwi\cNQLObRcg_t
RRRRt
t
x:5601504yy6049y15@618/7729C16?68B54/91D45@1zc`QOO[;1/B01B=3/2C6C1D6><@63314<12K2432>361251qQQNf]g{pp|}a~w|pqc[NpTnMLbs
eYLncpqc[[OjOP[nVS]NI
x916?=3/45254/918/C61@2<1>669106362<6C1/91/B0145€B>I
‚ƒ„ †‡‚ƒ
ˆ/961/:15@61=B>34812923H<4<1/:15@4<1KB39602>4345H176954/9<121E2K21832<<1B=3/2CI1‰@61ŠJFx106=/05123</176954/9<15@251‹FB><6ŒB695
06ŒB6<5<120615@69172C615/1C4606951xGJ169C=/495<15/1:B05@6016?=3/4515@61K48547Ž<1<H<567I‹1D@48@14<19/515@6182<61@606I1Š@2986<
2061495@6D43C12552860<172C61B<61/:129/5@6016?=3/45254/91=25@I1x9HD2H;15@61=258@12==346C1>H1‘292y6’9y4961/93H1A?6<15@6
=25@1502K60<2314<<B6I1“@4361285B233H1=06K69549y1/B016?=3/45254/9;15@4<1362K6<1/=696C15@61A361B=3/2C129C1=20276560149”6854/9
4<<B6<1:/01:B5B061B<6I

&%711 '%(#)"'#*11$+#%1& #"2326830*,%%!"#$%'&* 66162


0123120467869 2326830 !"#9$%

A7 -../0122.34..56789:2;-5<=8>560?53020.=.@02ABCDEBFDCGDACFHIFHB
F7 =7JJJ
R787-../01223337:=K=L55KL4K5789:2/[email protected]/=00396M2>R2-93P.9POS
C7 -../0122:5NM:56L5796L2
D7 -../0122-../M7=/[email protected]@NK56=R4N4.450UFB7-.:NVF7B7DA
X7 -../0122L4.-@R789:2/[email protected]:/N=.502RN9R2HH8CM8CX=8HMOS
H7 -../[email protected]=7L9Q2K8=02=N56.02==FAPFDG=
E7 =7JJ
R7-../[email protected]=K0P-=6M89M4KLPT9S

&%711 '%(#)"'#*11$+#%1& #"2326830*,%%!"#$%'&* 62162

You might also like