Actively exploited in the wild
Zoho ManageEngine ServiceDesk Plus Remote Code Execution Vulnerability
Zoho - ManageEngine ServiceDesk Plus (SDP) / SupportCenter Plus · Listed in the CISA KEV since 2021-12-01. This indicates confirmed attacks in production environments.
Required action: Apply updates per vendor instructions.
CVE-2021-44077
CriticalCVSS 9.8KEVSummary
Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014 are vulnerable to unauthenticated remote code execution. This is related to /RestAPI URLs in a servlet, and ImportTechnicians in the Struts configuration.
Risk Assessment
An attacker can remotely execute arbitrary code without authentication, leading to full compromise of the application server and potential data access. The vulnerability can be used to install malware or steal information.
Recommendation
Upgrade Zoho ManageEngine ServiceDesk Plus to version 11306 or later, ServiceDesk Plus MSP to 10530 or later, and SupportCenter Plus to 11014 or later. If upgrade is not possible, restrict access to the application from the internet.
Other vulnerabilities in Zoho ManageEngine ServiceDesk Plus
See all- CVE-2016-4889High
ZOHO ManageEngine ServiceDesk Plus before 9.0 allows remote authenticated guest users to leverage failure to restrict access to unknown functions, potentially leading to unspecified impact.
- CVE-2021-37415CriticalActively exploited
Zoho ManageEngine ServiceDesk Plus before 11302 is vulnerable to authentication bypass that allows a few REST-API URLs without authentication.
Original NVD description (English source)
Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014 are vulnerable to unauthenticated remote code execution. This is related to /RestAPI URLs in a servlet, and ImportTechnicians in the Struts configuration.