CVE-2021-42955: 
Zoho ManageEngine Remote Access Plus vulnerability analysis and mitigation

Zoho Remote Access Plus Server Windows Desktop binary prior to version 10.1.2132 is affected by an unauthorized password reset vulnerability. The vulnerability was discovered and disclosed in October 2021, affecting the password reset mechanism of the Remote Access Plus Server Admin account. The vulnerability allows any non-administrative Windows user to reset the password of the Remote Access Plus Server Admin account due to improper design of the password reset workflow (Nested Blog).

The vulnerability stems from improper design of the password reset workflow and lack of proper authentication verification mechanism. The application has weak file permission ACL (access control list) assigned in various locations, including the reset password executable file. The vulnerability has been assigned a CVSS v3.1 base score of 7.8 (HIGH) with vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The vulnerability is tracked as CWE-732 (Incorrect Permission Assignment for Critical Resource) (NVD).

Upon successful exploitation, an attacker can gain unauthorized admin access to the Remote Access Plus web portal. The web portal contains sensitive information including server configuration, deployed agent configuration, system information, vulnerability/patch status, user accounts, keys, and other critical details. The private key used for server authentication is also exposed (Nested Blog).

The vulnerability has been fixed in version 10.1.2132 of Zoho Remote Access Plus Server. Recommended security measures include preventing execution of reset scripts to limited user roles and implementing additional authentication methods such as security questions, email/SMS verification, or authenticator apps before password reset (Nested Blog).