CVE-2021-44515

🗓️ 12 Dec 2021 04:04:55Reported by mitreType

cve🔗 web.nvd.nist.gov📰️ 4 Media mentions👁 1094 Views🌐 WEB

Zoho ManageEngine Desktop Central vulnerability, authentication bypass, and remote code execution. Upgrade to secure builds

Reporter	Title	Published	Views	Family All 31
ATTACKERKB	CVE-2021-44515	20 Aug 202500:00	–	attackerkb
BDU FSTEC	The vulnerability of the software for the Zoho ManageEngine SupportCenter Plus service lies in its authentication procedures. This vulnerability allows a perpetrator to bypass the authentication process and gain unauthorized access to the device.	17 Dec 202100:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the ManageEngine Desktop Central software for managing workstations via a web interface stems from deficiencies in the authentication process. This allows a perpetrator to bypass the authentication procedures and execute arbitrary code.	20 Dec 202100:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the AgentLogUploadServlet component of the software for managing workstations via the web interface ManageEngine Desktop Central, as well as the remote monitoring and management tools for desktop PCs, servers, laptops, and mobile devices provided by ManageEngine Endpoint Central MSP (previously ManageEngine Desktop Central MSP), allows a malicious individual to circumvent security restrictions and execute arbitrary code.	7 Mar 202300:00	–	bdu_fstec
Circl	CVE-2021-44515	4 Dec 202106:14	–	circl
CISA KEV Catalog	Zoho Desktop Central Authentication Bypass Vulnerability	10 Dec 202100:00	–	cisa_kev
CISA	CISA Adds Thirteen Known Exploited Vulnerabilities to Catalog	10 Dec 202100:00	–	cisa
CISA	Zoho Releases Security Advisory for ManageEngine Desktop Central and Desktop Central MSP	6 Dec 202100:00	–	cisa
CISA	CISA Adds 13 Known Exploited Vulnerabilities to Catalog	10 Dec 202100:00	–	cisa
CNNVD	ZOHO ManageEngine Desktop Central MSP 授权问题漏洞	6 Dec 202100:00	–	cnnvd

NVD

Node

zohocorp manageengine_desktop_centralRange<10.1.2127.18enterprise

zohocorp manageengine_desktop_centralRange<10.1.2127.18managed_service_providers

zohocorp manageengine_desktop_centralRange10.1.2128.0–10.1.2137.3enterprise

zohocorp manageengine_desktop_centralRange10.1.2128.0–10.1.2137.3managed_service_providers

Source	Link
manageengine	www.manageengine.com/products/desktop-central/cve-2021-44515-authentication-bypass-filter-configuration.html
pitstop	www.pitstop.manageengine.com/portal/en/community/topic/an-authentication-bypass-vulnerability-identified-and-fixed-in-desktop-central-and-desktop-central-msp
cisa	www.cisa.gov/uscert/ncas/current-activity/2021/12/10/cisa-adds-thirteen-known-exploited-vulnerabilities-catalog
cisa	www.cisa.gov/known-exploited-vulnerabilities-catalog

Parameter	Position	Path	Description	CWE
loginName	query param	/STATE_ID/1337/changeDefaultAmazonPassword	Authentication bypass allows resetting admin password via crafted request.	CWE-287
newUserPassword	query param	/STATE_ID/1337/changeDefaultAmazonPassword	Authentication bypass allows resetting admin password via crafted request.	CWE-287

17 Jun 2026 04:12Current

9.6High risk

Vulners AI Score9.6

CVSS 3.19.8

CVSS 210

EPSS0.99867

SSVC

In Wild