TI-2021-19054 Aliases CVE-2021-42955 GHSA-g8wg-x53j-hvjq

Zoho Remote Access Plus Server Windows Desktop binary fixed in version 10.1.2132 is…

LOW 34CWE-732Published 2021-11-17 · Updated 2024-08-04

Key facts

Attack vector: Local
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

Zoho Remote Access Plus Server Windows Desktop binary fixed in version 10.1.2132 is affected by an unauthorized password reset vulnerability. Because of the designed password reset mechanism, any non-admin Windows user can reset the password of the Remote Access Plus Server Admin account.

Why it matters now

EPSS 0.00432 37th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA

— Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:zohocorp:manageengine_remote_access_plus::::::::	before 10.1.2132	Vulnerable	Zohocorp
cpe:2.3:o:microsoft:windows:-:::::::*	not specified by NVD	Running on	Microsoft

cpe:2.3:a:zohocorp:manageengine_remote_access_plus:*:*:*:*:*:*:*:* Versions before 10.1.2132 Vulnerable ·Zohocorp
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2021-42955
2026-10-03 Alias added: GHSA-g8wg-x53j-hvjq

References

Exploit 1

https://medium.com/nestedif/vulnerability-disclosure-improper-acl-unauthorized-password-reset-zoho-r-a-p-62efcdceb7a6

TI-2022-23765 Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003… KEVCVSS 3.1CRITICAL 9.8
TI-2020-12264 A design issue was discovered in GetInternetRequestHandle, InternetSendRequestEx and… CVSS 3.1HIGH 8.1
TI-2019-08483 Zoho ManageEngine Remote Access Plus 10.0.258 does not validate user permissions… CVSS 3.1HIGH 8.8
TI-2021-18451 Zoho ManageEngine Remote Access Plus before 10.1.2121.1 has hardcoded credentials associated with resetPWD.xml. CVSS 3.1HIGH 7.5
TI-2021-18450 Zoho ManageEngine Remote Access Plus before 10.1.2121.1 has hardcoded credentials for… CVSS 3.1HIGH 7.5
TI-2021-18452 Zoho ManageEngine Remote Access Plus before 10.1.2121.1 relies on the application's build… CVSS 3.1HIGH 7.5

See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences