CVE-2021-44757

Zoho ManageEngine Desktop Central before 10.1.2137.9 and Desktop Central MSP before 10.1.2137.9 allow attackers to bypass authentication, and read sensitive…

published January 18, 2022

CVSS
—
EPSS
24%
Percentile
97.9
In the wild
Unconfirmed
What it is

⚠️ An unprotected backdoor exists! Zoho ManageEngine Desktop Central before version 10.1.2137.9 allows attackers to stealthily bypass authentication and gain access to sensitive data. 📂 Think of this as a hotel with a side door that anyone can enter without a key — they can steal valuable items or even leave suspicious packages inside. 🏨 This vulnerability could lead to unauthorized users accessing sensitive information or uploading malicious ZIP files to the server. Imagine attackers walking right into your digital hotel room, rummaging through your valuables, and leaving dangerous surprises behind!

Put simply

Think of this as a hotel with a side door that anyone can enter without a key — they can steal valuable items or even leave suspicious packages inside. 🏨 The flaw allows attackers to bypass necessary authentication checks, enabling them to read private data or upload files without proper permission, making it a serious security lapse.

What to do

This vulnerability could lead to unauthorized users accessing sensitive information or uploading malicious ZIP files to the server. Imagine attackers walking right into your digital hotel room, rummaging through your valuables, and leaving dangerous surprises behind! To secure your systems, upgrade to Desktop Central version 10.1.2137.9 or later immediately. Additionally, review your access controls and monitor logs for any unauthorized activity. 🛡️ You've got this! By taking these steps, you'll help keep your digital hotel safe and sound! 🔒

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.24195 · 97.9th percentile
Published
2022-01-18T09:21Z
EPSS history
Timeline
  • 18 JAN 09:21Z
    Zoho ManageEngine Desktop Central before 10.1.2137.9 and Desktop Central MSP before 10.1.2137.9 allow attackers to bypass authentication, and read sensitive…
    cvelistv5