CVE-2021-41833: 
Zoho ManageEngine Patch Connect Plus vulnerability analysis and mitigation

CVE-2021-41833 is a critical security vulnerability affecting Zoho ManageEngine Patch Connect Plus versions before build 90099. The vulnerability was discovered and disclosed in October 2021, allowing unauthenticated remote code execution on affected systems (NVD, Vendor Advisory).

The vulnerability has been assigned a CVSS v3.1 base score of 9.8 (CRITICAL) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The vulnerability is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type). This indicates that the vulnerability requires no privileges or user interaction to exploit, and can be accessed from the network with low attack complexity (NVD).

The vulnerability allows attackers to execute remote code on affected systems without requiring any authentication. This could lead to complete system compromise, with potential impacts including unauthorized access to sensitive data, system modification, and service disruption (NVD).

Zoho has released a fix for this vulnerability in build 90099. Organizations using affected versions of ManageEngine Patch Connect Plus should immediately upgrade to this version or later to address the vulnerability (Vendor Advisory).