^{CVE-2021-44515:}Authentication Bypass Vulnerability in Zoho ManageEngine Desktop Central Leading to Remote Code Execution

Overview

This vulnerability (CVE-2021-44515) affects Zoho ManageEngine Desktop Central and Desktop Central MSP, which are unified endpoint management solutions. The authentication bypass vulnerability allows attackers to circumvent authentication controls, potentially leading to remote code execution on the server. The vulnerability was discovered and actively exploited in December 2021, prompting CISA to add it to their Known Exploited Vulnerabilities Catalog. This indicates the severity and active exploitation of the vulnerability in real-world attacks. The issue affects multiple versions of both Desktop Central and Desktop Central MSP products, putting organizations using unpatched versions at significant risk of unauthorized access and system compromise.

Remediation

Organizations using affected versions of Zoho ManageEngine Desktop Central or Desktop Central MSP should immediately apply the appropriate patches:

For Desktop Central Enterprise:

• If running build 10.1.2127.17 or earlier, upgrade to build 10.1.2127.18
• If running builds 10.1.2128.0 through 10.1.2137.2, upgrade to build 10.1.2137.3

For Desktop Central MSP:

• If running build 10.1.2127.17 or earlier, upgrade to build 10.1.2127.18
• If running builds 10.1.2128.0 through 10.1.2137.2, upgrade to build 10.1.2137.3

Additionally, organizations should:

• Monitor systems for signs of compromise
• Review logs for suspicious activities
• Implement network segmentation to limit potential lateral movement
• Consider temporarily isolating ManageEngine instances from the internet until patching is complete
• Follow the detailed guidance provided in Zoho's advisory documentation

References

1. Vendor Advisory: https://pitstop.manageengine.com/portal/en/community/topic/an-authentication-bypass-vulnerability-identified-and-fixed-in-desktop-central-and-desktop-central-msp
2. Patch Information: https://www.manageengine.com/products/desktop-central/cve-2021-44515-authentication-bypass-filter-configuration.html
3. CISA Advisory: https://www.cisa.gov/uscert/ncas/current-activity/2021/12/10/cisa-adds-thirteen-known-exploited-vulnerabilities-catalog
4. Known Exploited Vulnerabilities Catalog Entry by CISA confirming active exploitation