CVE-2021-42955
Zoho Remote Access Plus Server Windows Desktop binary fixed in version 10.1.2132 is affected by...
Zoho Remote Access Plus Server Windows Desktop binary fixed in version 10.1.2132 is affected by an unauthorized password reset vulnerability. Because of the designed password reset mechanism, any non-admin Windows user can reset the password of the Remote Access Plus Server Admin account.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Zoho Remote Access Plus Server Windows Desktop binary fixed in version 10.1.2132 is affected by an unauthorized password reset vulnerability. Because of the designed password reset mechanism, any non-admin Windows user can reset the password of the Remote Access Plus Server Admin account.
- Record
CVE-2021-42955- CVSS 3.1
- 7.3 High
CVSS:3.1/AC:L/AV:L/A:L/C:N/I:H/PR:L/S:C/UI:N - Updated
- 2026-11-02
EUVDEUVD-2021-29910
Zoho Remote Access Plus Server Windows Desktop binary fixed in version 10.1.2132 is affected by an unauthorized password reset vulnerability. Because of the designed password reset mechanism, any non-admin Windows user can reset the password of the Remote Access Plus Server Admin account.
- Record
EUVD-2021-29910- CVSS 3.1
- 7.3 High
CVSS:3.1/AC:L/AV:L/A:L/C:N/I:H/PR:L/S:C/UI:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-g8wg-x53j-hvjq
Zoho Remote Access Plus Server Windows Desktop binary fixed in version 10.1.2132 is affected by...
Zoho Remote Access Plus Server Windows Desktop binary fixed in version 10.1.2132 is affected by an unauthorized password reset vulnerability. Because of the designed password reset mechanism, any non-admin Windows user can reset the password of the Remote Access Plus Server Admin account.
- Record
GHSA-g8wg-x53j-hvjq- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-863
- Updated
- 2026-11-02
NVD
Zoho Remote Access Plus Server Windows Desktop binary fixed in version 10.1.2132 is affected by an unauthorized password reset vulnerability. Because of the designed password reset mechanism, any non-admin Windows user can reset the password of the Remote Access Plus Server Admin account.
- Record
CVE-2021-42955- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:L - CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.2 High
AV:L/AC:L/Au:N/C:C/I:C/A:C - Weakness
- CWE-732
- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-42955 is a high vulnerability (CVSS 7.3) in Zohocorp Manageengine Remote Access Plus, published November 17, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.43%, the 37th percentile. No source names a fixed version.