Zoho · Desktop Central
CVE-2021-44515
Zoho Desktop Central Authentication Bypass Vulnerability
What it is
Zoho ManageEngine Desktop Central is vulnerable to authentication bypass, leading to remote code execution on the server, as exploited in the wild in December 2021. For Enterprise builds 10.1.2127.17 and earlier, upgrade to 10.1.2127.18. For Enterprise builds 10.1.2128.0 through 10.1.2137.2, upgrade to 10.1.2137.3. For MSP builds 10.1.2127.17 and earlier, upgrade to 10.1.2127.18. For MSP builds 10.1.2128.0 through 10.1.2137.2, upgrade to 10.1.2137.3.
CISA: Zoho Desktop Central contains an authentication bypass vulnerability that could allow an attacker to execute arbitrary code in the Desktop Central MSP server.
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: December 24, 2021
- Added to the CISA list
- December 10, 2021
- Published
- December 12, 2021
- Severity
- Critical 9.8 CVSS 3.1
- Chance of attacks in the next 30 days (EPSS)
- 99.9% in the top 0.1% of all known vulnerabilities
- More details
- NVD · CVE.org · CISA
All references (3)
- https://pitstop.manageengine.com/portal/en/community/topic/an-authentication-bypass-vulnerability-identified-…
- https://www.manageengine.com/products/desktop-central/cve-2021-44515-authentication-bypass-filter-configurati…
- https://www.cisa.gov/uscert/ncas/current-activity/2021/12/10/cisa-adds-thirteen-known-exploited-vulnerabiliti…
More exploited flaws from Zoho
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Mar 7, 2023 | ADSelfService Plus Remote Code Execution | ManageEngine | Medium 6.8 | 71% |
| Jan 23, 2023 | Multiple Products Remote Code Execution | ManageEngine | Critical 9.8 | 99.8% |
| Sep 22, 2022 | Multiple Products Remote Code Execution | ManageEngine | Critical 9.8 | 99.9% |
| Dec 1, 2021 | ManageEngine ServiceDesk Authentication Bypass | ManageEngine ServiceDesk Plus (SDP) | Critical 9.8 | 99.8% |
| Dec 1, 2021 | ManageEngine ServiceDesk Plus Remote Code Execution | ManageEngine ServiceDesk Plus (SDP) / SupportCenter Plus | Critical 9.8 | 93% |
| Nov 3, 2021 | ServiceDesk Plus (SDP) File Upload | ManageEngine | High 7.5 | 63% |
| Nov 3, 2021 | Desktop Central File Upload | ManageEngine | Critical 9.8 | 99.9% |
| Nov 3, 2021 | ADSelfService Plus Authentication Bypass | ManageEngine | Critical 9.8 | 99% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.