CVE-2021-44515

Katalog CVE

CVSS 9.8 · Critical KEV · sudah dieksploitasi EPSS 99,9%

Kerentanan pada zohocorp manageengine desktop central. Skor CVSS 3.1 9.8 (Critical) menurut NVD. Masuk katalog KEV CISA pada 10 Desember 2021, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

Zoho ManageEngine Desktop Central is vulnerable to authentication bypass, leading to remote code execution on the server, as exploited in the wild in December 2021. For Enterprise builds 10.1.2127.17 and earlier, upgrade to 10.1.2127.18. For Enterprise builds 10.1.2128.0 through 10.1.2137.2, upgrade to 10.1.2137.3. For MSP builds 10.1.2127.17 and earlier, upgrade to 10.1.2127.18. For MSP builds 10.1.2128.0 through 10.1.2137.2, upgrade to 10.1.2137.3.

Rincian

Terbit di NVD

12 Desember 2021

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

EPSS (30 hari)

99,9% peluang dieksploitasi; lebih tinggi dari 99,9% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama

Zoho Desktop Central Authentication Bypass Vulnerability

Masuk KEV

10 Desember 2021

Tenggat CISA

24 Desember 2021 (untuk instansi federal AS)

Ransomware

Belum tercatat

Tindakan wajib

Apply updates per vendor instructions.

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://pitstop.manageengine.com/portal/en/community/topic/an-authentication-bypass-vulnerability-identified-a... issue tracking · advisory vendor
• https://www.manageengine.com/products/desktop-central/cve-2021-44515-authentication-bypass-filter-configuratio... exploit · patch · advisory vendor
• https://www.cisa.gov/uscert/ncas/current-activity/2021/12/10/cisa-adds-thirteen-known-exploited-vulnerabilitie... broken link · advisory pihak ketiga · pemerintah AS
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-44515 pemerintah AS