---
title: "ManageEngine DC auth bypass (CVE-2021-44515)"
canonical: https://trickest.com/library/cve-2021-44515-manageengine-desktop-central-auth-bypass-rce
description: "Flag ManageEngine Desktop Central for CVE-2021-44515 by reading 10.1.x builds on GET /configurations.do. Floors 10.1.2127.18 / 10.1.2137.3."
---

# ManageEngine DC auth bypass (CVE-2021-44515)

## Overview

This workflow finds Zoho ManageEngine Desktop Central and sorts each host by whether its 10.1.x build falls below the CVE-2021-44515 fixed floors. CVE-2021-44515 is an authentication bypass that can lead to remote code execution on vulnerable Desktop Central builds. This check never sends an auth-bypass request and never runs a payload. Give it hostnames, IP addresses, or URLs you are authorised to test. The workflow GETs `/configurations.do`, fingerprints Desktop Central from product markers on that page, parses the 10.1.x build, and compares it to the floors in the graph: 10.1.2127.18 and 10.1.2137.3. Every host comes back affected or not, so a fleet advisory becomes an evidenced list for [exposure management](/use-cases/exposure-management). There is no confirm step and no RCE claim from a crafted request.

Run it on a schedule when endpoint-management consoles change. A MSP edition that stayed on a 10.1.2127.x build is the reason the same fingerprint stays useful.

## Pipeline

1. Read the target list. Hosts, URLs, or ranges, one per line, become the scope.
2. GET `/configurations.do` on each host and fingerprint Desktop Central from markers such as ManageEngine Desktop Central 10, `buildNum`, `j_security_check`, and `DCJSESSIONID`.
3. Parse the 10.1.x build and compare it to the CVE-2021-44515 floors in the graph (10.1.2127.18 and 10.1.2137.3).
4. Collect the per-host rows: product match, version, vulnerable flag, and any fetch error.
5. Emit the summary counts: hosts checked, product hits, vulnerable, and errors.

## Inputs

- **Target scope.** Hostnames, IP addresses, CIDR ranges, or URLs, one per line. Full URLs and host:port entries work too, since the workflow normalizes each into a bare host. Point it at scope you are authorised to test.

## Outputs

- **results.jsonl.** One row per host: URL, whether Desktop Central was detected, the version read, the vulnerable flag, and detail text.
- **findings.jsonl.** The same per-host verdict shaped for triage, with severity set from the vulnerable flag.
- **summary.json.** Counts across the list: targets, product hits, vulnerable, and errors, plus the detection notes from the graph.

## Integrations

- HTTP. Unauthenticated GET of `/configurations.do` only. No auth-bypass request and no RCE payload.

## Sample output

The records below are illustrative and do not come from a real run. They show one Desktop Central host below a CVE-2021-44515 floor, one at or above its band floor, and one host that is not the product.

```jsonl
{"url": "https://dc.example.com", "is_product": true, "product_version": "10.1.2127.10", "vulnerable": true, "detail": "below band floor 10.1.2127.18"}
{"url": "https://dc.example.org", "is_product": true, "product_version": "10.1.2137.3", "vulnerable": false, "detail": "at or above fixed release"}
{"url": "https://shop.example.net", "is_product": false, "product_version": null, "vulnerable": false, "detail": "not identified as ManageEngine Desktop Central"}
```

```json
{"cve": "CVE-2021-44515", "total_targets": 3, "product_detected": 2, "vulnerable": 1, "errors": 0}
```

## FAQ

### Which Desktop Central versions does this flag?

10.1.x builds below the floors in the graph: 10.1.2127.18 (for builds through 10.1.2127.17) and 10.1.2137.3 (for 10.1.2128.0 through 10.1.2137.2). The same floors cover Enterprise and MSP editions. The compare uses the build the `/configurations.do` page itself served.

### Does an affected row mean auth bypass or RCE worked?

No. The check only GETs `/configurations.do` and reads the 10.1.x build. It does not send an auth-bypass request and it does not confirm RCE.

### Is this check safe on production?

Yes. It is a read-only unauthenticated GET of a public product page. It does not log in or change state.

### Does the check need credentials?

No. It fingerprints the public `/configurations.do` surface the way an external scanner would.

### What is CVE-2021-44515?

Authentication bypass in Zoho ManageEngine Desktop Central that can lead to remote code execution on vulnerable builds. This workflow maps hosts to that CVE by version exposure only.

## Related workflows

- [OMI OMIGOD unauth RCE (CVE-2021-38647)](/library/cve-2021-38647-omi-omigod-unauthenticated-rce). Reach for it when you need another management-agent unauth RCE fingerprint on the same estate.
- [Grafana snapshot auth bypass (CVE-2021-39226)](/library/cve-2021-39226-grafana-snapshot-auth-bypass). Reach for it when the next ops-console flag is Grafana snapshot auth bypass, not Desktop Central.

---
_Markdown source of https://trickest.com/library/cve-2021-44515-manageengine-desktop-central-auth-bypass-rce._