CVE-2021-44515 — Zoho ManageEngine Desktop Central Auth Bypass
What this checks: whether a Zoho ManageEngine Desktop Central host runs a version affected by unauth authentication bypass -> RCE. Read-only: it fingerprints Zoho ManageEngine Desktop Central and reads the version, no exploitation.
3. Detection — reads the Zoho ManageEngine Desktop Central version from the version exposed at /configurations.do, compares to 10.1.2127.18 (builds 10.1.2127.17 and below) / 10.1.2137.3 (builds 10.1.2128.0 to 10.1.2137.2); same for Enterprise and MSP editions. Flags vulnerable on an affected build. No exploitation.
1. Target List — paste your Zoho ManageEngine Desktop Central URLs here, one per line (e.g. https://host.example.com).
Overview
This workflow finds Zoho ManageEngine Desktop Central and sorts each host by whether its 10.1.x build falls below the CVE-2021-44515 fixed floors. CVE-2021-44515 is an authentication bypass that can lead to remote code execution on vulnerable Desktop Central builds. This check never sends an auth-bypass request and never runs a payload. Give it hostnames, IP addresses, or URLs you are authorised to test. The workflow GETs /configurations.do, fingerprints Desktop Central from product markers on that page, parses the 10.1.x build, and compares it to the floors in the graph: 10.1.2127.18 and 10.1.2137.3. Every host comes back affected or not, so a fleet advisory becomes an evidenced list for exposure management. There is no confirm step and no RCE claim from a crafted request.
Run it on a schedule when endpoint-management consoles change. A MSP edition that stayed on a 10.1.2127.x build is the reason the same fingerprint stays useful.
Pipeline
Read the target list. Hosts, URLs, or ranges, one per line, become the scope.
GET /configurations.do on each host and fingerprint Desktop Central from markers such as ManageEngine Desktop Central 10, buildNum, j_security_check, and DCJSESSIONID.
Parse the 10.1.x build and compare it to the CVE-2021-44515 floors in the graph (10.1.2127.18 and 10.1.2137.3).
Collect the per-host rows: product match, version, vulnerable flag, and any fetch error.
Emit the summary counts: hosts checked, product hits, vulnerable, and errors.
Inputs
Target scope. Hostnames, IP addresses, CIDR ranges, or URLs, one per line. Full URLs and host:port entries work too, since the workflow normalizes each into a bare host. Point it at scope you are authorised to test.
Outputs
results.jsonl. One row per host: URL, whether Desktop Central was detected, the version read, the vulnerable flag, and detail text.
findings.jsonl. The same per-host verdict shaped for triage, with severity set from the vulnerable flag.
summary.json. Counts across the list: targets, product hits, vulnerable, and errors, plus the detection notes from the graph.
Integrations
HTTP. Unauthenticated GET of /configurations.do only. No auth-bypass request and no RCE payload.
Sample output
The records below are illustrative and do not come from a real run. They show one Desktop Central host below a CVE-2021-44515 floor, one at or above its band floor, and one host that is not the product.
10.1.x builds below the floors in the graph: 10.1.2127.18 (for builds through 10.1.2127.17) and 10.1.2137.3 (for 10.1.2128.0 through 10.1.2137.2). The same floors cover Enterprise and MSP editions. The compare uses the build the /configurations.do page itself served.
Does an affected row mean auth bypass or RCE worked?
No. The check only GETs /configurations.do and reads the 10.1.x build. It does not send an auth-bypass request and it does not confirm RCE.
Is this check safe on production?
Yes. It is a read-only unauthenticated GET of a public product page. It does not log in or change state.
Does the check need credentials?
No. It fingerprints the public /configurations.do surface the way an external scanner would.
What is CVE-2021-44515?
Authentication bypass in Zoho ManageEngine Desktop Central that can lead to remote code execution on vulnerable builds. This workflow maps hosts to that CVE by version exposure only.