Zoho Releases Patch for Critical Flaw Affecting ManageEngine Desktop Central

Enterprise software maker Zoho on Monday issued patches for a
critical security vulnerability in Desktop Central and Desktop
Central MSP that a remote adversary could exploit to perform
unauthorized actions in affected servers.

Tracked as CVE-2021-44757^[1], the shortcoming
concerns an instance of authentication bypass that “may allow an
attacker to read unauthorized data or write an arbitrary zip file
on the server,” the company noted^[2]
in an advisory.

Osword from SGLAB of Legendsec at Qi’anxin Group has been
credited with discovering and reporting the vulnerability. The
Indian firm said it remediated the issue in build version
10.1.2137.9.

With the latest fix, Zoho has addressed a total of four
vulnerabilities over the past five months —

• CVE-2021-40539^[3]
  (CVSS score: 9.8) – Authentication bypass vulnerability affecting
  Zoho ManageEngine ADSelfService Plus
• CVE-2021-44077^[4]
  (CVSS score: 9.8) – Unauthenticated remote code execution
  vulnerability affecting Zoho ManageEngine ServiceDesk Plus,
  ServiceDesk Plus MSP, and SupportCenter Plus, and
• CVE-2021-44515^[5]
  (CVSS score: 9.8) – Authentication bypass vulnerability affecting
  Zoho ManageEngine Desktop Central

In light of the fact all the three aforementioned flaws have
been exploited by malicious actors, it’s recommended that users
apply the updates as soon as possible to mitigate any potential
threats.