BLACKOUT MAP

Zoho · Desktop Central

CVE-2021-44515

Zoho Desktop Central Authentication Bypass Vulnerability

공격에 악용됨 치명적 9.8 공격 가능성: 99.9%
공유

무엇인가

Zoho ManageEngine Desktop Central is vulnerable to authentication bypass, leading to remote code execution on the server, as exploited in the wild in December 2021. For Enterprise builds 10.1.2127.17 and earlier, upgrade to 10.1.2127.18. For Enterprise builds 10.1.2128.0 through 10.1.2137.2, upgrade to 10.1.2137.3. For MSP builds 10.1.2127.17 and earlier, upgrade to 10.1.2127.18. For MSP builds 10.1.2128.0 through 10.1.2137.2, upgrade to 10.1.2137.3.

CISA: Zoho Desktop Central contains an authentication bypass vulnerability that could allow an attacker to execute arbitrary code in the Desktop Central MSP server.

할 일

Apply updates per vendor instructions.

미국 연방 기관 조치 기한: 2021년 12월 24일

CISA 목록에 추가됨
2021년 12월 10일
게시됨
2021년 12월 12일
심각도
치명적 9.8 CVSS 3.1
향후 30일 내 공격 가능성(EPSS)
99.9% 알려진 모든 취약점 중 상위 0.1%
자세히
NVD · CVE.org · CISA
모든 참고 자료(3)

Zoho의 다른 악용된 결함

추가됨취약점제품심각도공격 가능성
2023. 3. 7.ADSelfService Plus Remote Code ExecutionCVE-2022-28810ManageEngine보통 6.871%
2023. 1. 23.Multiple Products Remote Code ExecutionCVE-2022-47966랜섬웨어에 사용됨ManageEngine치명적 9.899.8%
2022. 9. 22.Multiple Products Remote Code ExecutionCVE-2022-35405ManageEngine치명적 9.899.9%
2021. 12. 1.ManageEngine ServiceDesk Authentication BypassCVE-2021-37415ManageEngine ServiceDesk Plus (SDP)치명적 9.899.8%
2021. 12. 1.ManageEngine ServiceDesk Plus Remote Code ExecutionCVE-2021-44077ManageEngine ServiceDesk Plus (SDP) / SupportCenter Plus치명적 9.893%
2021. 11. 3.ServiceDesk Plus (SDP) File UploadCVE-2019-8394ManageEngine높음 7.563%
2021. 11. 3.Desktop Central File UploadCVE-2020-10189ManageEngine치명적 9.899.9%
2021. 11. 3.ADSelfService Plus Authentication BypassCVE-2021-40539랜섬웨어에 사용됨ManageEngine치명적 9.899%

모두 →

출처: Known Exploited Vulnerabilities(CISA, 퍼블릭 도메인), CVE records(cve.org), EPSS(FIRST). 공격 가능성은 누군가 향후 30일 안에 이 결함을 악용하려 할 확률에 대한 EPSS 추정치입니다.