CVE-2021-42955

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-11-17 · updated 2026-06-17
Weakness: CWE-732

Description

Zoho Remote Access Plus Server Windows Desktop binary fixed in version 10.1.2132 is affected by an unauthorized password reset vulnerability. Because of the designed password reset mechanism, any non-admin Windows user can reset the password of the Remote Access Plus Server Admin account.

Affected products

Zohocorp Manageengine Remote Access Plus: before 10.1.2132 — fixed in 10.1.2132

How to fix

Upgrade to a fixed version: Zohocorp Manageengine Remote Access Plus 10.1.2132. Check the vendor advisory for mitigations.

References

https://medium.com/nestedif/vulnerability-disclosure-improper-acl-unauthorized-password-reset-zoho-r-a-p-62efcdceb7a6
https://medium.com/nestedif/vulnerability-disclosure-improper-acl-unauthorized-password-reset-zoho-r-a-p-62efcdceb7a6

Get alerted when CVE-2021-42955 or the next vulnerability affects your stack