// For flags

CVE-2021-42954

 

Severity Score

7.8
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

1
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

Zoho Remote Access Plus Server Windows Desktop Binary fixed from 10.1.2121.1 is affected by incorrect access control. The installation directory is vulnerable to weak file permissions by allowing full control for Windows Everyone user group (non-admin or any guest users), thereby allowing privilege escalation, unauthorized password reset, stealing of sensitive data, access to credentials in plaintext, access to registry values, tampering with configuration files, etc.

Zoho Remote Access Plus Server Windows Desktop Binary corregido desde la versión 10.1.2121.1, está afectado por un control de acceso incorrecto. El directorio de instalación es vulnerable a permisos de archivo débiles al permitir el control total para el grupo de usuarios de Windows Everyone (no-admin o cualquier usuario invitado), permitiendo así una escalada de privilegios, el restablecimiento no autorizado de la contraseña, el robo de datos confidenciales, el acceso a las credenciales en texto plano, el acceso a los valores del registro, la manipulación de los archivos de configuración, etc

*Credits: N/A
CVSS Scores
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Local
Attack Complexity
Low
Authentication
None
Confidentiality
Partial
Integrity
Partial
Availability
Partial
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2021-10-25 CVE Reserved
  • 2021-11-17 CVE Published
  • 2023-06-10 EPSS Updated
  • 2024-08-04 CVE Updated
  • 2024-08-04 First Exploit
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-732: Incorrect Permission Assignment for Critical Resource
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Zohocorp
Search vendor "Zohocorp"
 Manageengine Remote Access Plus
Search vendor "Zohocorp" for product "Manageengine Remote Access Plus"
 < 10.1.2121.1
Search vendor "Zohocorp" for product "Manageengine Remote Access Plus" and version " < 10.1.2121.1"
-
Affected
in Microsoft
Search vendor "Microsoft"
 Windows
Search vendor "Microsoft" for product "Windows"
--
Safe