Critical Vulnerability in Zoho ManageEngine Desktop Central

Summary

Affected platforms

The following platforms are known to be affected:

Threat details

Remediation advice

Zoho has fixed the vulnerability in the latest build of Desktop Central, released on 3 December 2021. Affected organisations are required to apply updates immediately. There are no known workarounds.

Details on applying the updates can be found in CVE-2021-44515: Security Advisory and CVE-2021-44515: Security Advisory (Desktop Central for MSP).

Although Zoho has released a security update to remediate this vulnerability, prior exploitation may have been achieved already. Applying the security update will not negate any prior exploitation.

Zoho has provided further guidance to help identify if a system has been compromised by exploitation of this vulnerability, including their Exploit Detection Tool. Instructions on downloading and applying the tool can be found in CVE-2021-44515: Security Advisories (above). 

Definitive source of threat updates

• https://pitstop.manageengine.com/portal/en/community/topic/an-authentication-bypass-vulnerability-identified-and-fixed-in-desktop-central-and-desktop-central-msp
• https://www.manageengine.com/products/desktop-central/cve-2021-44515-authentication-bypass-filter-configuration.html
• https://www.manageengine.com/desktop-management-msp/cve-2021-44515-security-advisory.html

CVE Vulnerabilities