PT-2021-23699 · Zoho · Zoho Remote Access Plus Server

Published 2021-11-17 · Updated 2022-07-12 · CVE-2021-42954

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AC:L/AV:L/A:H/C:H/I:H/PR:L/S:U/UI:N

Name of the Vulnerable Software and Affected Versions Zoho Remote Access Plus Server Windows Desktop Binary versions prior to 10.1.2121.1

Description The issue is related to incorrect access control, where the installation directory has weak file permissions, allowing full control for the Windows Everyone user group. This includes non-admin and guest users, which can lead to privilege escalation, unauthorized password reset, stealing of sensitive data, access to credentials in plaintext, access to registry values, and tampering with configuration files.

Recommendations For versions prior to 10.1.2121.1, update to version 10.1.2121.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the installation directory to prevent unauthorized access until a patch is applied. Restrict access to sensitive data and credentials to minimize the risk of exploitation.

Exploit

Fix

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

CVE-2021-42954

Affected Products

Zoho Remote Access Plus Server

References · 4

• 🔥 https://medium.com/nestedif/vulnerability-disclosure-improper-filesystem-permission-misconfigured-acls-zoho-r-a-p-56e195464b51 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-42954 · Security Note
• https://osv.dev/vulnerability/CVE-2021-42954 · Vendor Advisory
• https://t.me/cibsecurity/32479 · Telegram Post