CVE-2021-41827

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Zoho ManageEngine Remote Access Plus before 10.1.2121.1 has hardcoded credentials for read-only access. The credentials are in the source code that corresponds to the DCBackupRestore JAR archive.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-798

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://medium.com/nestedif/vulnerability-disclosure-hardcoded-keys-password-zoho-r-a-p-318aa9bba2eExploit, Third Party Advisory
https://www.manageengine.com/remote-desktop-management/hotfix-readme.htmlVendor Advisory
https://medium.com/nestedif/vulnerability-disclosure-hardcoded-keys-password-zoho-r-a-p-318aa9bba2eExploit, Third Party Advisory
https://www.manageengine.com/remote-desktop-management/hotfix-readme.htmlVendor Advisory

Timeline

Published: Sep 30, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-418287.5Zoho ManageEngine Remote Access Plus before 10.1.2121.1 has hardcoded credentials associated with resetPWD.xml.CVE-2021-418297.5Zoho ManageEngine Remote Access Plus before 10.1.2121.1 relies on the application's build number to calculate a certain encryption key.CVE-2021-41835.5Crash in the pcapng file parser in Wireshark 3.6.0 allows denial of service via crafted capture file CVE-2021-418307.5It is possible for an attacker to manipulate signed documents and macros to appear to come from a trusted source. All versions of Apache Ope CVE-2021-418315.3It is possible for an attacker to manipulate the timestamp of signed documents. All versions of Apache OpenOffice up to 4.1.10 are affected.CVE-2021-418327.5It is possible for an attacker to manipulate documents to appear to be signed by a trusted source. All versions of Apache OpenOffice up to 4 CVE-2021-418339.8Zoho ManageEngine Patch Connect Plus before 90099 is vulnerable to unauthenticated remote code execution.CVE-2021-418346.5JFrog Artifactory prior to version 7.28.0 and 6.23.38, is vulnerable to Broken Access Control, the copy functionality can be used by a low-p CVE-2021-418357.5Fresenius Kabi Agilia Link + version 3.0 does not enforce transport layer encryption. Therefore, transmitted data may be sent in cleartext. CVE-2021-418364.8The Fathom Analytics WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and escaping via the CVE-2021-418378.2An issue was discovered in AhciBusDxe in the kernel 5.0 through 5.5 in Insyde InsydeH2O. Because of an Untrusted Pointer Dereference that ca CVE-2021-418388.2An issue was discovered in SdHostDriver in the kernel 5.0 through 5.5 in Insyde InsydeH2O. There is an SMM callout that allows an attacker t