CVE-2021-42955
High
Description
Zoho Remote Access Plus Server Windows Desktop binary fixed in version 10.1.2132 is affected by an unauthorized password reset vulnerability. Because of the designed password reset mechanism, any non-admin Windows user can reset the password of the Remote Access Plus Server Admin account.
SeverityHigh
CVSS7.3
Exploit probability—
ProductZohocorp Manageengine Remote Access Plus
PublishedNov 17, 2021
First seenNov 17, 2021
How to fix
Update
- zohocorp manageengine_remote_access_plus10.1.2132 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| zohocorp manageengine_remote_access_plus | v < 10.1.2132 | 10.1.2132 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.