First day on Intigriti: our agent harness found and proved a remote code execution bug, paid €3,000.

CVE-2021-42847

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Zoho ManageEngine ADAudit Plus before 7006 allows attackers to write to, and execute, arbitrary files.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected software

No affected versions have been published.

Timeline

Published: Nov 11, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-428485.3An information disclosure vulnerability was reported in some Lenovo Personal Cloud Storage devices that could allow an unauthenticated user CVE-2021-428496.8A weak default password for the serial port was reported in some Lenovo Personal Cloud Storage devices that could allow unauthorized device CVE-2021-42856.1A vulnerability classified as problematic was found in Nagios NCPA. This vulnerability affects unknown code of the file agent/listener/templ CVE-2021-428507.8A weak default administrator password for the web interface and serial port was reported in some Lenovo Personal Cloud Storage devices that CVE-2021-428515.3A vulnerability was reported in some Lenovo Personal Cloud Storage devices that could allow an unauthenticated user to create a standard use CVE-2021-428528.0A command injection vulnerability was reported in some Lenovo Personal Cloud Storage devices that could allow an authenticated user to execu CVE-2021-428539.8It was discovered that the SteelCentral AppInternals Dynamic Sampling Agent's (DSA) AgentDiagnosticServlet has directory traversal vulnerabi CVE-2021-428549.8It was discovered that the SteelCentral AppInternals Dynamic Sampling Agent's (DSA) PluginServlet has directory traversal vulnerabilities at CVE-2021-428557.8It was discovered that the SteelCentral AppInternals Dynamic Sampling Agent (DSA) uses the ".debug_command.config" file to store a json stri CVE-2021-428566.1It was discovered that the /DsaDataTest endpoint is susceptible to Cross-site scripting (XSS) attack. It was noted that the Metric parameter CVE-2021-428575.3It was discovered that the SteelCentral AppInternals Dynamic Sampling Agent's (DSA) AgentDaServlet has directory traversal vulnerabilities a CVE-2021-428597.5A memory leak issue was discovered in Mini-XML v3.2 that could cause a denial of service. NOTE: testing reports are inconsistent, with some