QID 730334

Date Published: 2022-01-21

QID 730334: Zoho ManageEngine Desktop Central and Desktop Central MSP Authentication Bypass Vulnerability (CVE-2021-44757)

Zoho ManageEngine Desktop Central is an integrated desktop and mobile device management software that helps in managing the servers, laptops, desktops, smart phones and tablets from a central point.

An authentication bypass vulnerability in ManageEngine Desktop Central that could result read unauthorized data or write an arbitrary zip file on the server.

Affected Versions:
For Enterprise:
Builds prior to 10.1.2137.9

For MSP:
Builds prior to 10.1.2137.9

QID Detection Logic:
Unauthenticated : This QID sends a GET request to /configurations.do to retrieve the build number of the Desktop Central on the remote target.
Authenticated : QID checks for vulnerable version of Zoho ManageEngine Desktop Central and Desktop Central MSP using registry path "HKLM\SYSTEM\CurrentControlSet\Services\DesktopCentralServer" or "HKLM\SYSTEM\CurrentControlSet\Services\DesktopCentralServerMSP"

If exploited, this vulnerability may allow an attacker to read unauthorized data or write an arbitrary zip file on the server.

CVSS V3 rated as Critical - 9.1 severity.

CVSS V2 rated as High - 6.4 severity.

Solution

Customers are advised to refer to ManageEngine Desktop Central for information pertaining to this vulnerability.

Vendor References

ManageEngine Desktop Central Advisory - pitstop.manageengine.com/portal/en/community/topic/a-critical-security-patch-released-in-desktop-central-and-desktop-central-msp-for-cve-2021-44757-17-1-2022

CVEs related to QID 730334

CVE-2021-44757 |

Software Advisories

Advisory ID	Software	Component	Link
ManageEngine Desktop Central Advisory			pitstop.manageengine.com/portal/en/community/topic/a-critical-security-patch-released-in-desktop-central-and-desktop-central-msp-for-cve-2021-44757-17-1-2022

By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].