CVE-2021-40539criticalunder attackransomwareCWE-706

CVE-2021-40539

Published · Updated

Follow this CVE+ Monitor ManageEngine ServiceDesk

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 9.8epss 99%
from disclosure to weapon10 days
Published on NVDSep 7
1st PoC+10d
metasploitSep 7
CISA KEV+57d
Action required by CISAfederal deadline: 2021-11-17

Apply updates per vendor instructions.

In short

A vulnerability in Zoho ManageEngine ADSelfService Plus allows attackers to bypass security checks on the REST API and execute malicious code remotely without proper authentication. This is critical because it gives complete control of the affected system.

Technical detail

REST API authentication bypass in ADSelfService Plus ≤6113 permits unauthenticated remote code execution. The vulnerability exists in API endpoint validation, allowing attackers to invoke privileged operations without valid credentials, resulting in arbitrary command execution with application privileges.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Zoho ManageEngine ADSelfService Plus version 6113 and prior is vulnerable to REST API authentication bypass with resultant remote code execution.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · n/a
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.