Security News > 2022 > January > Zoho plugs another critical security hole in Desktop Central
Zoho has addressed a new critical severity vulnerability that affects the company's Desktop Central and Desktop Central MSP unified endpoint management solutions.
ManageEngine Desktop Central is an endpoint management platform that allows admins to deploy patches and software over the network and troubleshoot them remotely.
Zoho has fixed the security flaw tracked as CVE-2021-44757 today and is now providing mitigation with the latest released Desktop Central and Desktop Central MSP versions.
The company also advised customers to follow its security hardening guidelines for Desktop Central and Desktop Central MSP. Today, a Shodan search revealed more than 2,800 ManageEngine Desktop Central instances exposed to attacks over the Internet if not patched.
In early December, Zoho patched another critical vulnerability that could allow threat actors to bypass authentication and execute arbitrary code on unpatched ManageEngine Desktop Central servers.
Desktop Central instances, in particular, have been hacked before and access to compromised networks sold on hacking forums since at least July 2020.
News URL
Related news
- Two simple give-me-control security bugs found in Optigo network switches used in critical manufacturing (source)
- CISA Warns of Critical Fortinet Flaw as Palo Alto and Cisco Issue Urgent Security Patches (source)
- HPE Issues Critical Security Patches for Aruba Access Point Vulnerabilities (source)
- Major security audit of critical FreeBSD components now available (source)
Related Vulnerability
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2022-01-18 | CVE-2021-44757 | Unspecified vulnerability in Zohocorp products Zoho ManageEngine Desktop Central before 10.1.2137.9 and Desktop Central MSP before 10.1.2137.9 allow attackers to bypass authentication, and read sensitive information or upload an arbitrary ZIP archive to the server. | 9.1 |