Actively exploited in the wild
Zoho Desktop Central Authentication Bypass Vulnerability
Zoho - Desktop Central · Listed in the CISA KEV since 2021-12-10. This indicates confirmed attacks in production environments.
Required action: Apply updates per vendor instructions.
CVE-2021-44515
CriticalCVSS 9.8KEVSummary
Zoho ManageEngine Desktop Central is vulnerable to authentication bypass, leading to remote code execution on the server, as exploited in the wild in December 2021. For Enterprise builds 10.1.2127.17 and earlier, upgrade to 10.1.2127.18; for Enterprise builds 10.1.2128.0 through 10.1.2137.2, upgrade to 10.1.2137.3; for MSP builds 10.1.2127.17 and earlier, upgrade to 10.1.2127.18; for MSP builds 10.1.2128.0 through 10.1.2137.2, upgrade to 10.1.2137.3.
Risk Assessment
An attacker can remotely execute arbitrary code on the server without authentication, leading to full system compromise and potential lateral movement. The vulnerability is actively exploited, increasing the risk.
Recommendation
Immediately upgrade Zoho ManageEngine Desktop Central to the recommended version based on your edition (Enterprise or MSP). If upgrade is not possible, isolate the server from the internet and monitor for suspicious activity.
Other vulnerabilities in Zoho ManageEngine Desktop Central
See all- CVE-2014-5006High
Directory traversal vulnerability in ZOHO ManageEngine Desktop Central (DC) before version 9 build 90055 allows remote attackers to execute arbitrary code via a .. (dot dot) in the fileName parameter to mdm/mdmLogUploader.
- CVE-2014-5005High
Directory traversal vulnerability in ZOHO ManageEngine Desktop Central before version 9 build 90055 allows remote attackers to execute arbitrary code via a .. (dot dot) in the fileName parameter in an LFU action to statusUpdate.
- CVE-2020-10189CriticalActively exploited
Zoho ManageEngine Desktop Central before 10.0.474 allows remote code execution because of deserialization of untrusted data in getChartImage in the FileStorage class. This is related to the CewolfServlet and MDMLogUploaderServlet servlets.
- CVE-2017-11346Critical
Zoho ManageEngine Desktop Central before build 100092 allows remote attackers to execute arbitrary code via vectors involving the upload of help desk videos.
- CVE-2017-7213Critical
Zoho ManageEngine Desktop Central before build 100082 allows remote attackers to obtain control over all connected active desktops via unspecified vectors.
Original NVD description (English source)
Zoho ManageEngine Desktop Central is vulnerable to authentication bypass, leading to remote code execution on the server, as exploited in the wild in December 2021. For Enterprise builds 10.1.2127.17 and earlier, upgrade to 10.1.2127.18. For Enterprise builds 10.1.2128.0 through 10.1.2137.2, upgrade to 10.1.2137.3. For MSP builds 10.1.2127.17 and earlier, upgrade to 10.1.2127.18. For MSP builds 10.1.2128.0 through 10.1.2137.2, upgrade to 10.1.2137.3.