PT-2021-6071 · Zoho+1 · Zoho Manageengine Servicedesk Plus+2

Published 2021-11-28 · Updated 2025-10-31 · CVE-2021-44077

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine ServiceDesk Plus versions prior to 11306 Zoho ManageEngine ServiceDesk Plus MSP versions prior to 10530 Zoho ManageEngine SupportCenter Plus versions prior to 11014

Description The issue is related to unauthenticated remote code execution and is associated with the lack of an authentication procedure. This can allow a remote attacker to execute arbitrary code. The vulnerability is related to /RestAPI URLs in a servlet and ImportTechnicians in the Struts configuration. It has been observed that cybercriminals are using this vulnerability, and 5.7% of all vulnerable software versions are used in Russia.

Recommendations For Zoho ManageEngine ServiceDesk Plus versions prior to 11306, update to version 11306 or later. For Zoho ManageEngine ServiceDesk Plus MSP versions prior to 10530, update to version 10530 or later. For Zoho ManageEngine SupportCenter Plus versions prior to 11014, update to version 11014 or later. As a temporary workaround, consider restricting access to the /RestAPI URLs in the affected servlet and disabling the ImportTechnicians function in the Struts configuration until a patch is applied.

Exploit

Fix

RCE

Improper Authentication

Missing Authentication

Weakness Enumeration

CWE-287

CWE-306

Related Identifiers

BDU:2022-00677

CVE-2021-44077

Affected Products

Struts

Zoho Manageengine Servicedesk Plus

Zoho Manageengine Supportcenter Plus

References · 34

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/manageengine_servicedesk_plus_cve_2021_44077.rb · Exploit
• 🔥 https://github.com/horizon3ai/CVE-2021-44077 · Exploit
• 🔥 http://packetstormsecurity.com/files/165400/ManageEngine-ServiceDesk-Plus-Remote-Code-Execution.html · Exploit
• https://osv.dev/vulnerability/CVE-2021-44077 · Vendor Advisory
• https://pitstop.manageengine.com/portal/en/community/topic/security-advisory-for-cve-2021-44077-unauthenticated-rce-vulnerability-in-servicedesk-plus-versions-up-to-11305-22-11-2021 · Vendor Advisory
• https://pitstop.manageengine.com/portal/en/community/topic/security-advisory-for-cve-2021-44077-unauthenticated-rce-vulnerability-in-servicedesk-plus-msp-versions-10527-till-10529 · Vendor Advisory
• https://pitstop.manageengine.com/portal/en/community/topic/security-advisory-for-cve-2021-44077-unauthenticated-rce-vulnerability-in-supportcenter-plus-versions-11012-and-11013 · Vendor Advisory
• https://pitstop.manageengine.com/portal/en/community/topic/security-advisory-authentication-bypass-vulnerability-in-servicedesk-plus-versions-11138-and-above · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-00677 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-44077 · Security Note
• https://t.me/true_secator/2416 · Telegram Post
• https://t.me/cybersecuritytechnologies/4947 · Telegram Post
• https://t.me/apt_notes/534 · Telegram Post
• https://t.me/malwr/5513 · Telegram Post
• https://t.me/aptreports/1009 · Telegram Post